101 reputation
1
bio website
location United States
age 29
visits member for 3 years, 11 months
seen Jun 15 '13 at 4:15

Aug
25
comment Should I force my users to change passwords every n days/weeks/month?
@bcat, you most certainly can check to see if new password is an easy permutation of their old password. In the case of the incrementing number suffix, simply decrement and increment the new passwords suffix (if it is a numeral) and compare its hash versus the previously stored hashes for that user. You could put other simple transformation checks in as well. All without storing passwords in plaintext.