Only the hottest memes in Cybersecurity
What is your favourite password rule?
Got this site once stating "passwords can't contain parts of username" icw a 64 character pw.
And usenames like "daneelolivaw" block passwords with
da an ne ee el...
dan ane nee eel ...
dane anee neel.... etc in them
I just wish these password requirements could be added as an attribute to the password field so password managers could generate a password that matches those rules.
My favorite is "can't be more than x% similar to the last 3 passwords". Of course, you shouldn't ever define what "similar" actually means.
And the only way to check that is by storing the previous passwords in a recoverable format.
I'm not sure but I think the previous password is mostly stored in an unrecoverable format and only upon changing your password, when you have to enter your previous one, does it store it in an unrecoverable format for 10x or so generations. Just a guess though for how AD might do it.