1478
Incorrect password
(i.imgur.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 Jul 2023
1478 points (98.2% liked)
Memes
45584 readers
1266 users here now
Rules:
- Be civil and nice.
- Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.
founded 5 years ago
MODERATORS
And despite security recommendations, too many IT depts still force password resets every 90 days...
And people confronted with this change their password from "p@55w0rd!1" to "p@55w0rd@2". Yep extra-secure!
Some IT guys have caught on to this and require 2 digits difference.
So "ThisJobSucks#11" becomes "ThisJobSucks#22"
How would they know how many digits changed? They don't store the password in cleartext.
Right?
...
No you don't need to store anything in clear text to check password parameters
But you need to know previous password if the objective is to make sure there's at least two characters difference compared to new password
No, because password hashes. Read this: https://security.stackexchange.com/questions/139738/company-can-tell-if-new-and-old-passwords-are-too-similar-is-there-a-security-p
I mean "because password hashes" is basically my original rational so not sure it qualifies as a counter argument.
But the link you provide is more explicit:
It is possible to hash all 1 character variations I guess, I kinda doubt that it is done often (does anyone know a library?).
I guess complexity increases linearly so password length is might not severely limit this mechanism. It would be interesting to see a calculation of how long it takes for a long password can to calculate all possibilities for 1 char variations for utf-8 or other charsets
Thanks for sharing the link!