News for hackers. Stuff that matters.

A comment on Auditor's response to "Our security auditor is an idiot" (Update 3). Parent comment

Re:Auditor's response to "Our security auditor is an idiot" ... by Someone on Friday July 29, 2011 @09:51AM (#2821711)
You do not have to retain plaintext passwords to implement that. Just remember the past X hashes, generate all passwords within edit distance D of the new one, and compare the two lists.

Edit distance 3, even with "letter stays letter, digit stays digit, random additions and removals" will already give millions of variants, so this may be impractical, but impossible? No.

[ Parent | on HN ]
Re:Auditor's response to "Our security auditor is an idiot" ... by Someone on Friday July 29, 2011 @09:56AM (#2821733)
Oops, I should remember to check whether my replies are still useful after taking a break for a couple of hours. Finishing a once-original reply and hitting submit not always is the best idea. Apologies.
[ Parent | on HN ]