One common issue with secure passwords is that users tend to "cheat", one common cheating pattern we meet recently is the "password swap" antipattern where the user basically keeps using the same two passwords forever. e.g.:
- Password1!
- Secret2$
- Password3!
- Secret4$
This antipattern works because:
- any new passwords is completely different from the previous one
- the history of hashes does not contain any exact match
is there any algorithm which is "similar" to an hash but allows to extract a distance metric from the current plain text password in order to avoid those risks?
Here is my analysis so far
- Hashing explicitly requires that "similiar" passwords turn to very different hashes: otherwise it would be very easy to converge from a generic password toward the one that generated the hash. Any "hash"-like algorithm which allows to calculate a metric of distance from the current password would be a security threat.
- I can't think of any workaround to come up with an hash which allows to measure "similarity" without giving away some kind of "distance" metric: which as stated above would render it insecure
- Another approach would be storing hashes of subsets of the password. E.g. we store the hash of the previous 10 passwords + the hash of the previous passwords minus the last two chars: this one would block the above example. However in order to work we might have to collect too many hashes of too small substrings (eg. every group of 6 chars) and this would give away the plain text password!