this post was submitted on 27 Jul 2023
461 points (98.3% liked)

Memes

45545 readers
1071 users here now

Rules:

  1. Be civil and nice.
  2. Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.

founded 5 years ago
MODERATORS
gary_host_laptop@lemmy.ml
sexy_peach@feddit.de
cyclohexane@lemmy.ml
cypherpunks@lemmy.ml
461
Incorrect password (i.imgur.com)
submitted 1 year ago by TheGoldenGod@lemmy.world to c/memes@lemmy.ml
80 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[โ€“] StimpyMGS@feddit.nl 0 points 1 year ago (2 children)

No, because password hashes. Read this: https://security.stackexchange.com/questions/139738/company-can-tell-if-new-and-old-passwords-are-too-similar-is-there-a-security-p

[โ€“] psilocybin@discuss.tchncs.de 1 points 1 year ago* (last edited 1 year ago)

I mean "because password hashes" is basically my original rational so not sure it qualifies as a counter argument.

But the link you provide is more explicit:

When the user enters the new password, the system generates the variations of the new password entered, hashes each one of them, and compares each hash against the old password's hash. If any of the hash matches, it throws an error. Else, it successfully changes the password

It is possible to hash all 1 character variations I guess, I kinda doubt that it is done often (does anyone know a library?).

I guess complexity increases linearly so password length is might not severely limit this mechanism. It would be interesting to see a calculation of how long it takes for a long password can to calculate all possibilities for 1 char variations for utf-8 or other charsets

Thanks for sharing the link!