It's funny because "DecemberSixteen" is very different from "MarchSeventeen" as a password from a characters point of view but is trivial to extrapolate if you know the guy has to change password every 3 months.
Why would they need to store the hash for all the combinations?
Why not generate a list of similar passwords to the new password, hash them all using the same salt of the previous password and then compare them.
Depending on what is considered "similar", every extra password character may exponentially increase the number of similar passwords.
Well in my case, there was only an 8 character limit, so there was a least a bound on it. I didn't investigate how far you could deviate from an old password before it was allowed though.
Re:Let them paste passwords
by Imagenuity on Thursday May 18, 2017 @03:54PM
(#14370537)
Been there, fought that.
longer passwords don't hash to longer values (within any reasonable variation of order of magnitude in input size). That would defeat the purpose of hashing
Re:Let them paste passwords
by squeaky-clean on Thursday May 18, 2017 @04:31PM
(#14370834)
But a longer password would require more combinations for similarity than a short password.
Ah. Thanks for clarifying.
Still, permutations longer hashes don't require substantially more space. Password storage is a completely trivial fraction of total storage -- Compare to a single photo, or a video!
And further still, they don't need to _store_ all the hash variations
https://security.stackexchange.com/questions/53481/does-face...
Re:Let them paste passwords
by squeaky-clean on Saturday May 20, 2017 @11:39PM
(#14385589)
Wow, it slipped my mind entirely that you could do the permutations when you create the new password but before verifying, rather than after creating a password. That's a great idea, and embarrassingly obvious in retrospect.
Developer: Similar passwords? Or Same passwords. Similar is hard.
M: Similar. Can't let people be lazy with their passwords.
D: Well, if we really have to do it, I guess we could store a bunch of hashed variations of the password, but...
M: Good! Let's do that.
D: ...but that could be a massive amount of space for long passwords.
M: Okay, we'll just enforce short passwords then.
D: ...doesn't that more than negate all the benefit of preventing similar passwords when rotating them?
M: Doesn't matter, the CEO said he wants this. Hop to it!
Developer laments the stupidity of their life