How to implement a safe password history

How to implement a safe password history

to add onto @martijnPieter's answer the minimal change can be implemented by doing a short brute force based on the new and previous passwords (which you both have available)

for example you can iterate over all passwords with a hamming distance of 1 or 2 from the new password and see if it matches an old pass

but you might want to note that this can reduce the confidence of users that you are hashing passwords (as you are essentially saying you can get a previous password back to reject a new password)

 

作者:Chuck Lu    GitHub