|visits||member for||4 years, 7 months|
|seen||Jun 15 '13 at 4:15|
Should I force my users to change passwords every n days/weeks/month?
@bcat, you most certainly can check to see if new password is an easy permutation of their old password. In the case of the incrementing number suffix, simply decrement and increment the new passwords suffix (if it is a numeral) and compare its hash versus the previously stored hashes for that user. You could put other simple transformation checks in as well. All without storing passwords in plaintext.