Hacker News Reader

I've used systems in the past that analyze them server side for similitude with previous passwords of your own (or perhaps only your last password? if that's the case, requiring current password would be enough, no need to store it in plain text).

They might also want to check it against a list of most used passwords.

View on HN

I vaguely remember Microsoft doing this, e.g. "You cannot use your old password and just add a number to it", but I might be mistaken and it may have been only blocking setting the password to a previous one.

All they'd have to do to safely achieve that is, when you initially set your password to "foo" they will store 11 hashes (foo, foo0, foo1, foo2...). Then when you change your password, it's hash cannot equal any previous hashes.

Or, even simpler: if the plaintext of the new password ends in a number, try stripping (or decrementing!) that number and see if either of those hash to the same as the stored old passwword.

Oops, yes of course! And then it can be any incrementable (or not) character.

Reply on news.ycombinator.com