Re: password aging

[Adam Shostack <adam () weathership homeport org>]

        Several people have suggested this, some in private mail.  If
you store old passwords in a different format than the OS, you may
well be opening up a security vulnerability.

        Here, I can trial passwords as l0phtcrack does, because you're
storing a hash, and forgot the salt.  Its likely that even with a
salt, you're still vulnerable to a faster attack than UNIX crypt.  So,
if you're implementing this stuff, be careful.



| I'm presuming that you should store hashes of previous passwords,
| and not store the actual passwords themselves.
| 
| From: Adam Shostack <adam () weathership homeport org>
| >     Various people assert that its a good idea to maintain a
| >history of user passwords so that they can't change their password to
| >a previous password.  However, I'm having trouble finding a reference
| >to this in the literature that examines the issue of how many
| >passwords to save and why.  The lime green book (password management)
| >says not to let the user use their previous password, but doesn't go
| >into storing a history.
| >