10

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is hashed, and unable to be reversed?

  • 5
    The computer would not know if they are similar. It would only know if they were identical (by hashing the new password and comparing it with the stored hash of the original password). – Robert Harvey Jan 17 at 3:25
  • Though, there are ways to generate a hash that capture part of the characteristics of the password. The availability of such hashes, however, are a great loophole, because password crackers can also make use of such information to narrow down the password brute-force search by many orders of magnitude. – rwong Jan 22 at 19:52
  • If you need to compare passwords, you won't use hashes. It's likely you will use AES or other forms of simetric encryption – Laiv Jan 22 at 21:51
14

One way to implement this is if you reset password, you are usually asked to enter your old password as well. You can simply just use regular string similarity comparison in that situation because you have both passwords in plaintext form at that point.

Another way to implement this is to normalise the password, for example accented characters are normalised to the closest English alphabets, try to transcribe the text phonetically, removing numbers, etc, and by precalculating multiple versions of the hashes that are generated from the password that had been normalised in different ways. Note that this weakens the hashing mechanism by unspecified amount. I wouldn't consider such to be security best practice.

  • "Reset password" generally refers to "I forgot my password and I want to reset it", so you wouldn't be asked for the old password. The second half of your answer is accurate though. – casablanca Jan 17 at 2:57
  • 3
    @casablanca: there are plenty of systems out there that have you "reset" your password every X days.... – whatsisname Jan 17 at 4:15
  • 1
    @casablanca: the first half is accurate as well, "resetting the password" can have both meanings, the terminology is not that rigid. We need to ask the OP what they meant precisely. – Doc Brown Jan 17 at 6:57
12

The simple answer is that a secure system does not know if they are similar.

But some systems intentionally reduce the security for a specific password in someways to prevent new passwords from being old passwords, or similar to them. The cost benefit trade off is that a new password will be created prior to someone malevolently cracking the current password even with the similarity information.

  • They might store the last N hashes of passwords that you have used. If you enter an old password its apparent because the new password hash matches an old password hash.
  • The hash mechanism used might contain a thumb nailing mechanism, or a hashed thumbnail might be stored alongside the hash. Essentially certain bit patterns within the hash thumbnail express a set of highly similar bit patterns in the underlying value.
  • Similarly they might keep statistics off to the side about your password, which would allow for an accurate measure of similarity.

In general each of these techniques reduces the security of passwords.

  • Keeping old passwords reduces the security of those passwords. Should any of those passwords be cracked, there is a high chance that the current password will be similar to them, most people only change a number.

  • Thumb nailing and statistics can eliminate bad password guesses more quickly than attempting to hash the guess and compare. This is because hashes, particularly secure-hashes are complicated to calculate and take effort, even if hardware accelerated. While a simpler calculation that says 'definitely not' or 'maybe' can eliminate most of those guesses, after all the similarity checks are meant to stop you using similar passwords, not from using a completely new password that looks nothing alike the old.

In short be wary of any site that indicates a similarity measure to your current/old password. Unless they are saying that the new password is the old password.

7

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is hashed, and unable to be reversed?

You generate multiple similar passwords from the one the user entered, and check whether any of their hashes matches the one of the old password.

  • Yes, people are quite predictable in the sorts of changes they'll make so this could be a decent way to do it. – cyborg Jan 17 at 15:43
  • That would blow up really quick in terms of processing needed with only the shortest passwords. So I do not believe this is a real practice. – Martin Maat Jan 18 at 6:49
  • I worked at one place for quite a long time, and when I left my password was supersecurepassword39. (Only the last two digits are true). It's obvious if a password begins or ends with a number to see if the previous number was used. – gnasher729 Jan 23 at 1:01
  • @MartinMaat Would it though? You can detect say adding or incrementing a number by eliding characters one by one from the original password. I.e. for “password”, you hash “assword” (heehee), “pssword”, “pasword” etc. You might even get away with using a weaker has for these because of the additional complexity of having to try 256 permutations of each one if you happen to bruteforce the secondary hash. (More if you store them in random order and you don’t know which character was elided in which one, then it’s 256*N for each one.) – millimoose Jan 25 at 15:58
  • It does make setting a new password N-times more expensive when N is the password length, not including the similarity checks which should be much less expensive than hashing. But you hash passwords every time a user signs in, and this probably happens a lot more often than password changes, so I doubt the additional load would be that noticeable. – millimoose Jan 25 at 16:39
2

Another pattern is your system hashes some characteristic subsets of your password and stores those hashes to check if subsets of the new password matches any of the old, ie: password: "Admin2018" & subset: "Admin" = cannot enter "Admin2019" as new one.

1

One way would be to store the past five hashed passwords in a table like 'Password History' and when user is trying to set a new password, hash it and compare against the hashed passwords in the table.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.