Comment by repeekad
2 days ago
I’ve personally experienced the password change require that “more than X characters be different than the old password”
2 days ago
I’ve personally experienced the password change require that “more than X characters be different than the old password”
Um, that's a really bad sign...
No, you can do it safely. The idea is to have the password renewal process also ask for the previous password.
This means the password changing method doesn't need to store a plaintext password, but still has access to the old plaintext password when changing. It's still not a great idea, but that's because nagging your users will see them choose worse passwords.
Oh so trivially bypassable by changing your password twice.
To elaborate for the uninitiated, that means they are storing it in plaintext somewhere.
Unless they ask you for your current password as part of the password change flow.
No it doesn't. Shows you how complicated all this is and how the un-initiated (including me) should learn to not give their two cents.
When you do the password change it asks you for the old one, that's how it knows.
So it asks for old + new, checks old is correct against the hash, and then compares old + new likeness.
So it all happens in memory.
Is there any way to check that with non-plain-text password?
3 replies →
Not if the check is done client-side, so the plain password never leaves you local domain. Of course the check being done client-side means that it isn't difficult to skip if you are inclined to make a smidgin of effort.
It can be done server side too, the old password can be sent along the new one and the server can verify it.