Cybersecurity - Memes

There's really nothing wrong with that, it's a sort of half-baked 1.5FA, I would hope/assume you had to immediately change your password after.

Australian Army still does this.

That just means they're forcing everyone to change their passwords but they don't want to come out and tell you about it.

If you're lucky, some overzealous sysadmin is just trying to enforce regular password updates on his users, and makes them expire every once in a while.

More likely, there was a breach of some sort that they want to keep on the hush.

I can imagine one legitimate case: when you create a password, they save the hash for the full password as well as the hash for the password without the last character. So if you attempt to change only the last character, they can detect it. They'd need to salt the two separately though.

In theory, they could do the same for every character, but they'd have to save 20+ combinations for that (plus all the salt), so I doubt anyone is doing that.

They pay a kid in Bangladesh 14c an hour to visually compare the new password against the old one.

Usually you have to enter your old password on the same form in order to set a new one.

Alternatively they could run a bunch of common substitutions on the new password, hash, and check if anything matches the old hash.

I mean they could technically check common password modifications and test all of those hashes against your old hash to see, if they're storing plaintext and you should delete your account immediately.

My guess is the latter is correct

You gotta salt yer hash, that's how you bring out the flavour!

The old passwords don't have to be stored in plain text. They can still be hashed and salted.

You're like, so close.

Don't reuse passwords between different services, or after a password reset. You're aware of exactly why that's a bad practice (a compromise of any one of those services, or an old database of those services will expose that password), so why knowingly bear that risk?

Last time I had to implement a feature like that, I stored a substring of the old password's hash. If one User in a million gets a False quotation Mark same Passwort quotation Mark message, I can live with it.

I mean, that's true if you reuse your passwords instead of using a password manager that can generate random gibberish... Which is itself a very poor habit exactly because of this very fact?

Even assuming a company follows best practices (a bold assumption that is wholly inconsistent with reality) there's ALWAYS a possibility of a breach - and it's not if, it's only when.

So, everyone should be using a password manager by default.

I like to use keepassXC personally because it's fully under my control. I don't really care for ones that are hosted by 3rd parties because that introduces more risk if they get beached, but for many people that's fine; it's more convenient for the user. To me it's important enough that I manage it all locally.

I probably still use those old passwords for at least 20 other logins.

Right at the top of the list of things not to do with a password.

Someone with your Amazon account might assume you use Facebook, Youtube, Steam, and every bank around your location(they know). There's 2factor, but not everywhere

Nah it pulls your plain text password in after you enter your email to compare it to 🙂

This form can be used to brute force or dictionary guess passwords and infer what they are without a limitation on login attempts. Even if the password has already been invalidated on that service, finding a collision on this service gives you a password that might work on other services for the same email address/username

Well when the website is so helpful and give you instant feedback on the correctness of your password... Then it would do that to hackers as well.

Definitely a thing, usually a debounce meaning it waits half a second after the last key stroke to perform validation.

Because in order to know that the password is the same before submission, it has to store it in plaintext (or I guess it could hash every input and compare it immediately but no way that's happening).