Hacker News new | ask | show | jobs
by thyrsus 4347 days ago
They're storing passwords in the clear, otherwise they wouldn't be able to enforce the "cannot be too similar" rule.
1 comments

Not necessarily — if you require the user to type in "old password" and "new password" when they change their password then you have both passwords in cleartext at once and can check for similarity.

You wouldn't be able to enforce "cannot be similar to the previous 8 passwords" like that, but they don't.