• Blackmist@feddit.uk
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      Well they don’t need to store it to a drive. You just entered your old password in order to login and authorise your password change.

      It’ll still be in memory against your session.

    • Hawk@lemmy.dbzer0.com
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      Used to have monthly changes for a Microsoft account. When trying to change, it said “You used this password 6 months ago, please use another”, besides the “passwords needs to be at least this different” message. Clearly they are storing them, not sure if they’re stored cleartext or they’re decrypting them on the fly somehow

      • psilocybin@discuss.tchncs.de
        link
        fedilink
        arrow-up
        5
        ·
        edit-2
        1 year ago

        You should not be able to decrypt a password, passwords aren’t encrypted but hashed, they would be insecure would they be encrypted.

        Hashing differs from encryption in that it is irreversible, because two or more strings might result in the same hash if the hashing function is applied to them (hashing is not injective).

        But since your password will always yield the same hash you can compare the two hashes and if they are equal you are considered authenticated. If you try to log in with a different password (or even the hash of the correct password) then it will produce a different hash resulting in a failed authentication attempt

        The way crackers get a password if they have the hash is by guessing pw candidates and using the hash function on them, if its the same as the hash they have they found the/a valid password. The guessing can be quite involved and with enough time and data about a victim often 12-13 digit passwords with special characters and all can be cracked - If the victim used a somewhat mnemonic pw that is. Generated pws from a password safe are much safer (but usually also longer).

        In your case I suspect MS was storing a history of hashes which is not advisable as it gives potential crackers more to work with, but its way less bad then storing plain text or encrypting passwords

    • StimpyMGS@feddit.nl
      link
      fedilink
      arrow-up
      1
      arrow-down
      1
      ·
      1 year ago

      No you don’t need to store anything in clear text to check password parameters

      • Xanvial@lemmy.one
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        But you need to know previous password if the objective is to make sure there’s at least two characters difference compared to new password

          • psilocybin@discuss.tchncs.de
            link
            fedilink
            arrow-up
            2
            ·
            edit-2
            1 year ago

            I mean “because password hashes” is basically my original rational so not sure it qualifies as a counter argument.

            But the link you provide is more explicit:

            When the user enters the new password, the system generates the variations of the new password entered, hashes each one of them, and compares each hash against the old password’s hash. If any of the hash matches, it throws an error. Else, it successfully changes the password

            It is possible to hash all 1 character variations I guess, I kinda doubt that it is done often (does anyone know a library?).

            I guess complexity increases linearly so password length is might not severely limit this mechanism. It would be interesting to see a calculation of how long it takes for a long password can to calculate all possibilities for 1 char variations for utf-8 or other charsets

            Thanks for sharing the link!

    • Reliant1087@lemmy.world
      link
      fedilink
      arrow-up
      1
      arrow-down
      2
      ·
      1 year ago

      You could take the old password, change one or two letters and compare the hash to the hash of the new password?

      • psilocybin@discuss.tchncs.de
        link
        fedilink
        arrow-up
        7
        ·
        1 year ago

        That’s the point though.

        You’re not supposed to have the old password. If you had the old password you could just compare it to the new password.

        The only way you can do it is to take the new password and make a hash for every possible single-character variation and compare them all to the old hash

        • abraxas@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          They shouldn’t be storing the old password hashed, either. Expired password hashes should be destroyed like any other potentially-sensitive information that is no longer business critical.

          There is a reason hackers look to get users tables even though the passwords are hashed. Because with enough of them and enough time, they can usually figure out plaintext. Giving them 10 previous hashed passwords for each user is just increasing the hypothetical risk.

          • psilocybin@discuss.tchncs.de
            link
            fedilink
            arrow-up
            2
            ·
            1 year ago

            You’re right ofc if you wanted to make a general remark, but wrong if you thought that was what I was implying. Never store hash histories, kids!

        • Reliant1087@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Sorry, that’s what I meant as well :) Came out upside down when I wrote. We used to figure out shitty ISP router passwords this way by having a table of common passwords and their hashes.