• Xanvial@lemmy.one
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      But you need to know previous password if the objective is to make sure there’s at least two characters difference compared to new password

        • ashe@lemmy.starless.one
          link
          fedilink
          arrow-up
          1
          ·
          edit-2
          1 year ago

          It’s not because hashes, it’s because usually you have to input the old password to change it. Even the answers from the link you sent say so.

        • psilocybin@discuss.tchncs.de
          link
          fedilink
          arrow-up
          1
          ·
          edit-2
          1 year ago

          I mean “because password hashes” is basically my original rational so not sure it qualifies as a counter argument.

          But the link you provide is more explicit:

          When the user enters the new password, the system generates the variations of the new password entered, hashes each one of them, and compares each hash against the old password’s hash. If any of the hash matches, it throws an error. Else, it successfully changes the password

          It is possible to hash all 1 character variations I guess, I kinda doubt that it is done often (does anyone know a library?).

          I guess complexity increases linearly so password length is might not severely limit this mechanism. It would be interesting to see a calculation of how long it takes for a long password can to calculate all possibilities for 1 char variations for utf-8 or other charsets

          Thanks for sharing the link!