Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I believe this situation would be similar to many others out there, so maybe some of you can shed some light...

Supposedly, when making password changes through MS exchange every 90 days, you cannot use any simple variation of one of your old passwords, up to whatever limit the admin's set for a system.

My question: If your previous passwords are only stored as hashes, how can they check for the "just changed one letter" case. Wouldn't they have to have access to the old plain-text passwords in order to make those comparisons?

The only other thing I can think of is if upon original creation of a password, they also stored all other one character permutations of it, so that they can be banned later?

share|improve this question
    
This could be one for security.se or perhaps even maths.se –  Mark Henderson Mar 19 '12 at 22:20
add comment

1 Answer

Take the new password, try every combination where one character is different, see if the hash matches the old stored hash. Not that complicated.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.