Re: password aging

["H. Morrow Long" <morrow.long () yale edu>]

I'm presuming that you should store hashes of previous passwords,
and not store the actual passwords themselves...                - Morrow

From: Adam Shostack <adam () weathership homeport org>
>       Various people assert that its a good idea to maintain a
> history of user passwords so that they can't change their password to
> a previous password.  However, I'm having trouble finding a reference
> to this in the literature that examines the issue of how many
> passwords to save and why.  The lime green book (password management)
> says not to let the user use their previous password, but doesn't go
> into storing a history.
>
>       Does anyone know of a paper on, or that discusses, this topic, 
> and how or why to pick various values of N?
>
> Adam