Re:49% of workers, forced to change passwords, reuse same on...
by loeg on Sunday December 15, 2019 @06:46PM
(#21799780)
You could imagine a scheme where they just store N salted hashes of your N-character previous password with 1 character deleted. Then at password changes, they do the same iteration with the candidate password and see if any digests match. This tells them if you made a 1 character change to your password, without storing your old password in plaintext.
[ Parent
| on HN ]
Re:49% of workers, forced to change passwords, reuse same on...
by boring_twenties on Tuesday December 17, 2019 @09:56PM
(#21821352)
Yeah... they could be doing that. But these are the same people that implemented the forced password change in the first place. The overwhelming likelihood is that they're storing them in plain text, and the jury might still be out on whether that plain text is world-readable or not.