News for hackers. Stuff that matters.

A comment on Auditor's response to "Our security auditor is an idiot" (Update 3). Parent comment

Re:Auditor's response to "Our security auditor is an idiot" ... by zizee on Friday July 29, 2011 @05:23AM (#2820907)
That was my first thought too, but it does not satisfy the "similar" part of the requirement.
[ Parent | on HN ]
Re:Auditor's response to "Our security auditor is an idiot" ... by saurik on Friday July 29, 2011 @05:31AM (#2820932)
It does, because if the new password is similar to the old one, you can either modify the old one to get the new one or modify the new one to get the old one.
[ Parent | on HN ]
Re:Auditor's response to "Our security auditor is an idiot" ... by zizee on Monday August 08, 2011 @02:11AM (#2859012)
But if you have hashed the password correctly (i.e. a one way hash) you shouldn't know what the previous passwords are. This means that you would only be able to test if the password was the same, not similar.
[ Parent | on HN ]