Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You'll need to store passwords in clear for this, not a good idea.


Not necessarily, you can have the user input the old password when setting up the new one, check it against the old hash and if it matches, do whatever comparisons you need between old and new.


Even if you don’t want users last 10 passwords to be “similar” (by whatever your definition of similar is), you can still hash the similar variants when you hash the original and check them.

I’m not saying whether this is a good idea or not. I haven’t thought through it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: