How on earth can you both not accept the password I copied from my password safe and tell me that I cannot use the same pasaword again?
How on earth can you both not accept the password I copied from my password safe and tell me that I cannot use the same pasaword again?
Yeah. The real reason to be alarmed is worse than the obvious one.
If a partial version of what was originally set actually works later, it implies a scary chance they’re not even hashing the password before storing it.
I think it’s a nonzero chance they’re not hashing it. Pretty much every hashing function, in the interest of preventing collisions, provides vastly different responses on small amounts of input. Even if they were hashing it, it would just appear to be the same password in a situation where they somehow got a collision, but again, the column length for passwords would always be fixed since a hash function always outputs the same data length.
Also suggests the user may be reusing the same prefix if only the changed bits are getting truncated.
Should use different random passwords every time. Completely random or a random string of words. While it doesn’t solve the cleartext password storage issue, a data breach won’t compromise all your other accounts to same degree.
Doesn’t hurt to also randomize usernames, emails, and even security question answers.
edit: or my new favorite passkeys, just make sure you trust whatever tool is managing your private keys.