John Summerfied wrote:
Les Mikesell wrote:On Tue, 2006-04-04 at 23:04, Mikkel L. Ellertson wrote:You keep copies of the old encrypted passwords around, and compare the new one to them. If they match, reject the password. After all, you do that to the current one every time someone tries to log in.Create a test account, fred. Set fred's password to, say, derf. Take a note of the encrypted password. Change Fred's password to derf. Compare with the previous encrypted password. Are they the same?
They are, taking into account the salt. One doesn't compare the
newly encrypted password, one compares the new password
encrypted with the salt of the old password, and compares that.
Mike
--
p="p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
You have found the bank of Larn.
I can explain it for you, but I can't understand it for you.
I speak only for myself, and I am unanimous in that!
