Microsoft says mandatory password changing is “ancient and obsolete” (2019)

Re:Microsoft says mandatory password changing is “ancient an... by ben0x539 on Monday April 19, 2021 @04:41PM (#26867731)

If you encrypt the prior passwords using a key derived from the current password, you're enabling this sort of check on password change without really sacrificing security, don't you?

[ Parent | on HN ]

Re:Microsoft says mandatory password changing is “ancient an... by dragonwriter on Monday April 19, 2021 @07:53PM (#26869178)

> If you encrypt the prior passwords using a key derived from the current password,

How can you do that with a prior password if you didn’t store it as plaintext when it was current? You can’t encrypt something you don’t have. Unless you are encrypting the old hash, not the password.

[ Parent | on HN ]

Re:Microsoft says mandatory password changing is “ancient an... by eropple on Monday April 19, 2021 @09:59PM (#26869931)

You would have it during the password change if you did old-new-new_again, yeah?

[ Parent | on HN ]

Re:Microsoft says mandatory password changing is “ancient an... by ben0x539 on Tuesday April 20, 2021 @09:35PM (#26884396)

Yeah that was the idea. I guess a lot of apps don't actually do that and just email you password reset links, in which case you can't actually recover the old password. :<

[ Parent | on HN ]

Re:Microsoft says mandatory password changing is “ancient an... by rovr138 on Wednesday April 21, 2021 @08:58AM (#26889041)

This leaks data if a collision can be found and exploited.

Assuming the user uses the password in other places, this can be a bad thing.

[ Parent | on HN ]