Re:Microsoft says mandatory password changing is “ancient an...
by dragonwriter on Monday April 19, 2021 @07:53PM
(#26869178)
> If you encrypt the prior passwords using a key derived from the current password,
How can you do that with a prior password if you didn’t store it as plaintext when it was current? You can’t encrypt something you don’t have. Unless you are encrypting the old hash, not the password.
Re:Microsoft says mandatory password changing is “ancient an...
by ben0x539 on Tuesday April 20, 2021 @09:35PM
(#26884396)
Yeah that was the idea. I guess a lot of apps don't actually do that and just email you password reset links, in which case you can't actually recover the old password. :<
How can you do that with a prior password if you didn’t store it as plaintext when it was current? You can’t encrypt something you don’t have. Unless you are encrypting the old hash, not the password.