Hacker News Reader

Comment by Klathmon | Hacker News Reader

The "must be changed every 30 days" always annoys me to no end.

A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password.

Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise.

So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...

View on HN

> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...

Or do <password>, <password>1, <password>2, ...

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

> Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords".

(╯°□°）╯︵ ┻━┻

I don't know how people who don't use password managers are able to deal with this kind of crap at all.

  ┬─┬ノ(º_ºノ) calm down, take it easy.

they do not deal with it, they reuse passwords increasing the degree if the problem

If a website warns me about this, I immediately remove my account. Because if they can tell how similar my new password is to my old password, it means they store information about my password.

I do use a password manager however, so I don’t really notice.

So how do they know it's similar ? Is there a distance that could be calculated between 2 hashes and tell if they are similar ?

I don't think so... So are your old passwords stored in plain text somewhere so they can compare ?

Scary...

> Is there a distance that could be calculated between 2 hashes and tell if they are similar ?

Yes, maybe: https://en.wikipedia.org/wiki/Locality-preserving_hashing

> So are your old passwords stored in plain text somewhere so they can compare?

You betcha!

Thanks for your answers :)

That is not always feasible. There are also requirements like your passwords should be different in atleast 3 places.

If they're able to detect that, then it's basically guaranteed that they're not hashing their passwords.

Reply on news.ycombinator.com