Re: WinNT and previously used passwords

["Roland Postle" <mail () blazde co uk>]

> Presumably, if your new password is based
> on your old one, I would probably be able to crack the new one just as
> easily as the old one, and it allows me to do so using 1/11th the amount
> of work, assuming you are storing 10 passwords.

I don't know the details of NT password hashsing but often if you
concentrated on cracking all 11 passwords instead of just the current one,
you would get your first one of them (approximately) 11 times faster
(because the time to do the hashing part of the algorithm dwarfs the
comparison bit). Things like salts complicate that a bit.

Besides the human problem with passwords that KF's talking about there's
also the problem of password resuse. Because I have a habit of 'downgrading'
passwords the last 10 passwords on my system might get someone into all
kinds of things like my Yahoo! account, my Sourceforge account, a not often
used Hotmail account etc.... For other people it might be much worse. And
someone's going to have a lot longer to crack them and use them than if they
went for a current password that was changing regularly.

- Blazde