Hacker News Reader

Comment by fapjacks | Hacker News Reader

Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.

View on HN

> Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords".

(╯°□°）╯︵ ┻━┻

I don't know how people who don't use password managers are able to deal with this kind of crap at all.

  ┬─┬ノ(º_ºノ) calm down, take it easy.

they do not deal with it, they reuse passwords increasing the degree if the problem

If a website warns me about this, I immediately remove my account. Because if they can tell how similar my new password is to my old password, it means they store information about my password.

I do use a password manager however, so I don’t really notice.

So how do they know it's similar ? Is there a distance that could be calculated between 2 hashes and tell if they are similar ?

I don't think so... So are your old passwords stored in plain text somewhere so they can compare ?

Scary...

> Is there a distance that could be calculated between 2 hashes and tell if they are similar ?

Yes, maybe: https://en.wikipedia.org/wiki/Locality-preserving_hashing

> So are your old passwords stored in plain text somewhere so they can compare?

You betcha!

Thanks for your answers :)

Reply on news.ycombinator.com