News for hackers. Stuff that matters.
Re:Frequent reauth doesn't make you more secure by klysm on Thursday June 12, 2025 @10:53PM (#44265348)
To elaborate for the uninitiated, that means they are storing it in plaintext somewhere.
Re:Frequent reauth doesn't make you more secure by mx_03 on Thursday June 12, 2025 @10:58PM (#44265365)
Is there any way to check that with non-plain-text password?
Re:Frequent reauth doesn't make you more secure by jchw on Thursday June 12, 2025 @11:00PM (#44265372)
Actually it can be trivial as long as you can require the user to re-type the current password when entering a new password; check hash first, then check edit distance with the entered "current password" (and, of course, promptly throw it away once you know the edit distance.)
Re:Frequent reauth doesn't make you more secure by nullify88 on Friday June 13, 2025 @02:11AM (#44266112)
Ohh. I guess that's what Windows does when a user wants to change their own password in the domain.
Re:Frequent reauth doesn't make you more secure by mrspuratic on Friday June 13, 2025 @04:20AM (#44266738)
It does more than that, it keeps a hashed password history (which used to be in the user attr ntPasswdHistory, but is now "somewhere secret" afaik) according to the value of ms-DS-Password-History-Length attribute. OpenLDAP keeps these (ppolicy overlay) in the user object.

So, it can hash any proposed password and compare the history to make it's not been seen $recently (as an exact match, since it's comparing hashes).

It could also perform some minor permutations of any new password, and do the same history check to make sure you're not just changing the first or last character or digit. I don't know if it does this, but it could.

Re:Frequent reauth doesn't make you more secure by _moof on Friday June 13, 2025 @02:37AM (#44266212)
Unless they ask you for your current password as part of the password change flow.
Re:Frequent reauth doesn't make you more secure by mattmanser on Friday June 13, 2025 @03:41AM (#44266548)
No it doesn't. Shows you how complicated all this is and how the un-initiated (including me) should learn to not give their two cents.

When you do the password change it asks you for the old one, that's how it knows.

So it asks for old + new, checks old is correct against the hash, and then compares old + new likeness.

So it all happens in memory.