this post was submitted on 26 May 2025
560 points (96.2% liked)
Cybersecurity - Memes
2916 readers
1 users here now
Only the hottest memes in Cybersecurity
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What gets me is the "password is too similar to old password".
How do they know? Are they storing them in plain text? I would imagine the hash would change drastically even if I change a single character, no?
I can imagine one legitimate case: when you create a password, they save the hash for the full password as well as the hash for the password without the last character. So if you attempt to change only the last character, they can detect it. They'd need to salt the two separately though.
In theory, they could do the same for every character, but they'd have to save 20+ combinations for that (plus all the salt), so I doubt anyone is doing that.
No need to store it, you can do the opposite, create 20 variations of the new password, hash them, check if any match with the old password.
Edit : nevermind, it would only work if they added data instead of editing it.