thats always been a concern for me.

if my past passwords can be examined for comparison with a current one, i cant shake the idea that no password is secret under such a regime

This is still compatible with one way hashing. The service just sits on the recent hashes. They’re still non reversible.

yes, we have to trust it is done like that, as a standard.

i suppose an "evil admin" has a lot of other ways to harvest passwds, rather than one that is a major security problem.