Linked Questions
20 questions linked to/from Does Facebook store plain-text passwords?
7
votes
2
answers
4k
views
How facebook knows my new password is too similar to my old password? [duplicate]
I am still very new to Information Security field and as far as I know, websites use hashing algorithm on user's passwords before storing it and they don't know the plain-text password of a user.
...
- 1,139
944
votes
11
answers
330k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.5k
561
votes
3
answers
103k
views
Why can I log in to my Facebook account with a misspelled email/password?
I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
- 3,705
59
votes
6
answers
14k
views
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
- 27.2k
35
votes
4
answers
10k
views
Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?
I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
- 526
33
votes
4
answers
8k
views
Does Facebook storing old passwords compromise security? [duplicate]
Facebook stores old password hashes (along with the old salt), such that if you try to log in with a previous password, Facebook tells you that you updated the password (and when). Nice user ...
- 443
12
votes
7
answers
5k
views
How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]
Let's say that in the password policy the password history is defined to remember the last 10 passwords.
I understand password history exists so that if a password is recovered from a compromised ...
- 1,736
48
votes
1
answer
10k
views
Facebook password lowercase and uppercase [duplicate]
Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
- 639
34
votes
2
answers
4k
views
Why does Facebook bother comparing old and new passwords?
An answer to this question says Facebook generates a bunch of password guesses to see if they hash the same as a previous version of the password.
Why bother? If a service forces every password to ...
22
votes
2
answers
8k
views
Company can tell if new and old passwords are too similar. Is there a security problem? [duplicate]
I've spoken to an employee of a big international company in germany.
He said, employees are warned if their new password is too similar to the old password. (e.g. if they change the password from ...
- 375
24
votes
3
answers
5k
views
Do servers store my previous passwords?
When I change my password on some web servers like email, cloud, and social networks and try to use my previous password, the server denies it with message "Don't use your previous passwords".
Does ...
- 1,085
11
votes
8
answers
6k
views
Sequential password updates
Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse.
What's to stop the user from changing the ...
- 2,831
10
votes
3
answers
7k
views
How can I store a password history to prevent reuse?
I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt.
How can I implement a password history set (to prevent password reuse) in a ...
- 203
4
votes
4
answers
3k
views
How to tell if a site is securely storing passwords? [closed]
A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
- 49
12
votes
4
answers
1k
views
Password security
I was requested at the login page of a website to first change my password. After typing in a new password, the web page told me the new password did not differ enough from the previous one.
Does this ...
- 123