Quote:
Originally Posted by anomie
In this particular case, I'd argue that the latter - being able to pick a similar, strong password - is better. How are you going to keep the old passwords encrypted? (Where will the encryption key live? Point is: some part of your process is going to either have a key or an old password stored as cleartext.)
|
A hacker using the PCL library will generate a list of passwords based on guesses of what the password contains. But I admit I've had the same though. Adding 4 characters to an old password at each change would make it easier to remember a very long random like passphrase.
