Linked Questions

33
votes
4answers
7k views

Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
12
votes
4answers
1k views

Password security

I was requested at the login page of a website to first change my password. After typing in a new password, the web page told me the new password did not differ enough from the previous one. Does this ...
4
votes
4answers
3k views

How to tell if a site is securely storing passwords? [closed]

A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
520
votes
3answers
87k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
24
votes
3answers
4k views

Do servers store my previous passwords?

When I change my password on some web servers like email, cloud, and social networks and try to use my previous password, the server denies it with message "Don't use your previous passwords". Does ...
10
votes
3answers
1k views

Logging “password with counter” use

When prompted to update their passwords after they've become stale (whether that's after 30, 60, 90 days — whatever is implemented by policy), many users simply increment the number that they may have ...
10
votes
3answers
4k views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
6
votes
3answers
883 views

Similarity comparisons with hashed passwords possible?

At a company I worked at, I had to change my password every 90 days and I could only reuse a password after 8 iterations. This no-reusal included passwords being too similar to the old one, e.g. when ...
4
votes
3answers
465 views

How can a company tell if my password is similar to the previous 5 passwords?

Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem? Also closely related (but not a duplicate): How can a system enforce a ...
4
votes
3answers
1k views

Does cPanel store my login password as plaintext

On attempt to change my cPanel password I was warned that: Your password could not be changed because the new password failed with the following reason : (is too similar to the old one), please try ...
0
votes
3answers
1k views

Testing a password for similarity to previous hashes

This question is a follow-up to a comment by Tobias Kienzler to an answer to "What is the purpose of the “Password minimum age” setting?". Consider a password policy that new passwords cannot be ...
32
votes
2answers
4k views

Why does Facebook bother comparing old and new passwords?

An answer to this question says Facebook generates a bunch of password guesses to see if they hash the same as a previous version of the password. Why bother? If a service forces every password to ...
20
votes
2answers
5k views

Company can tell if new and old passwords are too similar. Is there a security problem? [duplicate]

I've spoken to an employee of a big international company in germany. He said, employees are warned if their new password is too similar to the old password. (e.g. if they change the password from ...
6
votes
2answers
3k views

How facebook knows my new password is too similar to my old password? [duplicate]

I am still very new to Information Security field and as far as I know, websites use hashing algorithm on user's passwords before storing it and they don't know the plain-text password of a user. ...
48
votes
1answer
8k views

Facebook password lowercase and uppercase [duplicate]

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...

15 30 50 per page