News for hackers. Stuff that matters.
Re:Let them paste passwords by SamBam on Thursday May 18, 2017 @11:16AM (#14367928)
I think it would decrease the benefit, yes.

If you store the hash of the password, plus the hash of a hundred "similar" passwords, then the hacker only has to brute-force one to find that they are on the right track, and then brute-force "similar" combinations.

Re:Let them paste passwords by MikeTV on Thursday May 18, 2017 @11:25AM (#14368000)
Unless you do it the other way around: Generate a list of all passwords similar to the one the user just entered and see if that matches any previous hashes. This is how Facebook's password check works [0]

[0] https://security.stackexchange.com/a/53483

Re:Let them paste passwords by dainichi on Thursday May 18, 2017 @11:08PM (#14372757)
Supposedly, you'd only be able to get feedback about the similarity of a password in a state where you're already authenticated. So I guess this would help an attacker get the password when they've already gained access in some other way. But that's a big assumption.