# Should I be concerned that websites keep track of old passwords? **URL:** \ **Category:** Factual Questions\ **Created:** [October 11, 2021, 4:58pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309 "2021-10-11T16:58:59Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [October 11, 2021, 4:58pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/1 "2021-10-11T16:58:59Z")
So, I’m working from home this AM, and had to access a non-frequent website. Naturally, my password expired, so I did the 2FA thing, and typed in a new password. The site responded, “_This password has been used in the past 7 passwords. Please choose another new password._” This kind of caught me off guard. Are websites ~~saving~~ tracking my old passwords now? How concerned should I be about this? I change them often enough, and don’t use repeat passwords across sites, but couldn’t someone determined enough, across enough sites, figure out a pattern to narrow down a brute-force attempt? Tripler I need to change my luggage code from “1 2 3 4 5.” ---
**Author:** ![Kimera757](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kimera757/32/3765_2.png) [@Kimera757](https://boards.straightdope.com/u/Kimera757)\ **Post date:** [October 11, 2021, 5:17pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/2 "2021-10-11T17:17:41Z")
I think it’s saving, not tracking, but in encrypted format. I use a password manager, to avoid sharing passwords. Of course, I’m too lazy to update passwords regularly. ---
**Author:** ![hende](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@hende](https://boards.straightdope.com/u/hende)\ **Post date:** [October 11, 2021, 5:21pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/3 "2021-10-11T17:21:41Z")
IF the website is properly storing the passwords (salted + hashed) you don’t have much to be concerned about. They should only be storing the previous hashes of your password and simply need to compare your newly entered password against them. Hashing is not reversible, so your passwords are theoretically safe if a bad actor were to get access to the websites database. Rainbow tables can be used to compare known hashed password values against a database, but a good salt should prevent that. Note: Encrypting and Hashing are two different things. In almost all circumstances, passwords should be stored as hashed values and NOT encrypted. Encryption is by definition reversible while hashing is not. ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [October 11, 2021, 5:21pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/4 "2021-10-11T17:21:42Z")
Saving your last 7 passwords is no different than saving your current password. It’s encrypted. So if you’re not worried about them saving your current password (which they have to do, because that’s how you log in) then don’t worry about it. If you are worried about it, create 8 new random passwords every time they ask you to change. Then the 7 saved passwords are guaranteed to not be used anywhere else. The best you can do is to not use the same passwords across sites so you are doing what you can to avoid being compromised. ---
**Author:** ![Stranger\_On\_A\_Train](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Stranger\_On\_A\_Train](https://boards.straightdope.com/u/Stranger_On_A_Train)\ **Post date:** [October 11, 2021, 5:47pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/5 "2021-10-11T17:47:46Z")
> [@Tripler](#): > > This kind of caught me off guard. Are websites ~~saving~~ tracking my old passwords now? How concerned should I be about this? I change them often enough, and don’t use repeat passwords across sites, but couldn’t someone determined enough, across enough sites, figure out a pattern to narrow down a brute-force attempt? Preventing near-reuse (e.g. changing a password by a single digit) is a very common security measure. The passwords are still stored as an unrecoverable hash (or, at least, should be) and they just cycle through each single character with the alphanumeric sequence and compared the hashed password, so if you change two or three characters, it should meet requirements. Assuming the password is made up of N characters from the ASCII character set, a single character change would require N\*128 permutations, and checking two independent characters would be N2-N)\*128 2 permutations, so for an 8 character password 1024 and 917504 hash-and-compare (H&C) operations, but in general it will become computationally prohibitive with additional characters C with N!/(N-C)!\*128C (I think I got that right), so 3 or 4 changed characters in an 8 character password the number of H&C operations would be over 450 million and 704 billion, respectively. So, as long as you are making more than two digit changes to a password and the website has reasonable security, changing more than a couple of characters should prevent any brute force hacking attempts. Of course, if the website is keeping a plaintext registry of passwords (yes, some do even though it is trivially easy today to hash passwords) or there is some man-in-the-middle vulnerability that allows a cracker to grab the password before it is hashed, you are still vulnerable. Such vulnerabilities are surprisingly common, hence why [major corporations get hacked with disturbing frequency and little accountability.](https://innovationatwork.ieee.org/10-largest-corporate-hacks-recent-history/) It would be computationally prohibitive to check every permutation of two independently; assuming a 128 character set, a single change would be 128\*N, but two independent changes would be ( > [@Tripler](#): > > I need to change my luggage code from “1 2 3 4 5.” I wouldn’t bother. The TSA locks that are the only lock you are now allowed to use to secure your luggage [aren’t worth the pot-metal zinc alloy they are made out of even notwithstanding the wide availability of the TSA master key](https://youtu.be/GhESSMvf_to). Even if a thief isn’t clever enough to buy a $5 TSA #7 lock off of Amazon, there is essentially no security in luggage handling areas. I had a Pelican case that went through Orlando airport security, and some aspiring defalcator had enough time and unimpeded access to both drive the hinge pin mostly out of the rear hinge and use a hacksaw to clumsily finish the job. (Why they didn’t just use the hacksaw or a cheap Harbor Freight bolt cutter to just cut the worthless locks off and save me the trouble of having to requisition a new Pelican just indicates how little thought it takes to be a luggage thief.) Fortunately, all they got was a few hand tools, a cheap flashlight, and a metric shit-ton of lockwire, and my biggest loss was a pair of good lockwire pliers that I haven’t been able to replace, but pretty much anything you send through airport luggage is about as secure as a keg at a frat party. Given the fees airlines have been charging for “oversized” and overweight luggage, I’ve taken to just cargo shipping anything valuable because as careless as UPS about accurately tracking shipments they are still way more reliable and accountable as airlines and airport cargo contractors who just shrug their shoulders when you show them a piece of luggage that has been slashed, pried, or torched (no kidding!) open. “Master Locks generally cry out for this sort of treatment.”. — The Lock-Picking Lawyer Stranger ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [October 11, 2021, 5:55pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/6 "2021-10-11T17:55:47Z")
Thanks guys!! Knowing it’s a reputable government website, I reckon that everything is locked up adequately. > [@Stranger\_On\_A\_Train](#): > > The TSA locks that are the only lock you are now allowed to use . . . Interesting, I wonder if I can still transport firearms with my own lock–but that’s another thread topic of its own. I, like you, had a couple of instances where my _clearly marked_ Pelican cases were jimmied open, and the loss of a couple of my ‘prior occupation’s’ hand tools occurred. Tripler Salt and hash makes me breakfast hungry. ---
**Author:** ![Stranger\_On\_A\_Train](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Stranger\_On\_A\_Train](https://boards.straightdope.com/u/Stranger_On_A_Train)\ **Post date:** [October 11, 2021, 5:58pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/7 "2021-10-11T17:58:46Z")
> [@Tripler](#): > > Knowing it’s a reputable government website, I reckon that everything is locked up adequately. [![](http://media.giphy.com/media/n1RENjIzHtveU/giphy.gif) ](http://media.giphy.com/media/n1RENjIzHtveU/giphy.gif) > **[Defense Systems](https://www.defenseone.com/defense-systems/)** Stranger ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [October 11, 2021, 6:04pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/8 "2021-10-11T18:04:15Z")
I know, I know. . . _Everyone_ has my federal records by now. I should have put “sarcasm” tags into play. Tripler Sometimes I think the SDMB is the most secure site I frequent. ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [October 11, 2021, 6:20pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/9 "2021-10-11T18:20:16Z")
Just to assuage my confusion about why you’d care if they kept a bunch of old passwords, even if they weren’t hashed – you’re not using the same password on more than one site, right? That’s a terrible practice that greatly increases your vulnerability if one site is compromised. ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [October 11, 2021, 6:25pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/10 "2021-10-11T18:25:21Z")
> [@markn\_1](#): > > you’re not using the same password on more than one site, right? That’s correct, I don’t reuse passwords across sites. Passwords are like underwear: they help protect what’s close to you, need to be changed often, and aren’t good to spread around for everyone to see. Tripler I was my ~~passwords~~ skivvies after one wear. ---
**Author:** ![Stranger\_On\_A\_Train](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Stranger\_On\_A\_Train](https://boards.straightdope.com/u/Stranger_On_A_Train)\ **Post date:** [October 11, 2021, 6:32pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/11 "2021-10-11T18:32:07Z")
> [@markn\_1](#): > > Just to assuage my confusion about why you’d care if they kept a bunch of old passwords, even if they weren’t hashed – you’re not using the same password on more than one site, right? That’s a terrible practice that greatly increases your vulnerability if one site is compromised. The concern, I suspect, is being able to detect a pattern of how passwords are made. Some people like to take names and replace vowels with numbers, others use famous phrases slightly altered, and so forth. The reality is that as long as your password has a reasonable amount of complexity and the website has some marginal level of security (locking the account after some number of attempts, refusing multiple simultaneous authentications, ensuring that the password hash isn’t accessible from outside) then even relatively simple passwords with repeated patterns are adequately secure as long as you aren’t reusing the same password across different sites. Outlandish complexity requirements and frequency of change actually do almost nothing to improve security and may actually make things worse. My current organization requires a 16 digit password with no English words that has to be changed on 90 day intervals. Guess what most people do ‘remember’ their frequently changing password? Stranger ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [October 11, 2021, 6:56pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/12 "2021-10-11T18:56:44Z")
> [@Stranger\_On\_A\_Train](#): > > The concern, I suspect, is being able to detect a pattern of how passwords are made. That’s my concern. I don’t reuse passwords, but I admit that I use terms and phrases from my past to help me generate new secure ones. I’m not nearly as imaginative or randomized as certain secure algorithms are, so I assume I have a pattern. Don’t get me started on the three random security questions. 🙄 Tripler I’m still thinking about salty hash–lunchtime! ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [October 11, 2021, 6:59pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/13 "2021-10-11T18:59:01Z")
Yeah, restrictions on the form of passwords is a pet peeve of mine. I use a password manager that hashes the website name along with a secret key, and then uses the hash to construct a 10 character password that’s guaranteed to have at least one uppercase, one lowercase, one digit and one punctuation. (Per [Kerckhoff’s principle](https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle), all the security is in the key; I don’t care if everything else about my system is known.) But occasionally I run into a website that doesn’t accept the punctuation character, or has some other restriction that doesn’t accept my default password, making it tempting to just use a one-off easily rememberable password for that site. Sites should not require a password format; it just decreases the size of the password space and encourages writing them down, using memorable passwords, or otherwise using insecure techniques. ---
**Author:** ![Stranger\_On\_A\_Train](https://avatars.discourse-cdn.com/v4/letter/s/13edae/32.png) [@Stranger\_On\_A\_Train](https://boards.straightdope.com/u/Stranger_On_A_Train)\ **Post date:** [October 11, 2021, 7:02pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/14 "2021-10-11T19:02:22Z")
> [@Tripler](#): > > Don’t get me started on the three random security questions. 🙄 Those questions are actually enormous vulnerabilities, especially the predetermined ones that request publicly available information like the schools you’ve attended or your mother’s maiden name. Passwords in general are not very good security (again, because people write them down) but if you can socially hack the password change process there isn’t even a need to worry about brute force or computational vulnerabilities, because you are basically being handed a key blank and wax impression, and just need to do a bit of filing to open the lock. Stranger ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 11, 2021, 9:24pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/15 "2021-10-11T21:24:35Z")
> [@Stranger\_On\_A\_Train](#): > > Outlandish complexity requirements and frequency of change actually do almost nothing to improve security and may actually make things worse. My current organization requires a 16 digit password with no English words that has to be changed on 90 day intervals. Guess what most people do ‘remember’ their frequently changing password? It could be worse. There’s a site we’re supposed to use at work, and we all had accounts set up for us. We all got a message in our work email, “Click here to finish setting up your account”, and then it said that all we had to do to finish setting up our account was to create a password. And, as soon as we did so and then logged in with the brand-new password, the site came back with “Your password has expired. Please change it.” ---
**Author:** ![tavaritz](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tavaritz](https://boards.straightdope.com/u/tavaritz)\ **Post date:** [October 12, 2021, 2:38pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/16 "2021-10-12T14:38:22Z")
I’ve met sites and games where passwords can not contain anything else than numbers and letters. How bizzare is that? I’m immediately wondering how are they storing the password if it has to be alphanumerical string. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [October 12, 2021, 2:56pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/17 "2021-10-12T14:56:47Z")
Fuck yes, you should be concerned. The website does not need to know your password. That’s why zero-knowledge password protocols exist. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [October 12, 2021, 3:02pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/18 "2021-10-12T15:02:19Z")
Wikipedia knows all: > **[Zero-knowledge password proof](https://en.wikipedia.org/wiki/Zero-knowledge_password_proof)** > > In cryptography, a zero-knowledge password proof (ZKPP) is a type of zero-knowledge proof that allows one party (the prover) to prove to another party (the verifier) that it knows a value of a password, without revealing anything other than the fact that it knows the password to the verifier. The term is defined in IEEE P1363.2, in reference to one of the benefits of using a password-authenticated key exchange (PAKE) protocol that is secure against off-line dictionary attacks. A ZKPP prevents any... > [@](#): > > A common use of a zero-knowledge password proof is in authentication systems where one party wants to prove its identity to a second party using a password but doesn’t want the second party or anybody else to learn anything about the password. For example, apps can validate a password without processing it and a payment app can check the balance of an account without touching or learning anything about the amount. ---
**Author:** ![Bill\_Door](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Bill\_Door](https://boards.straightdope.com/u/Bill_Door)\ **Post date:** [October 12, 2021, 6:18pm UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/19 "2021-10-12T18:18:24Z")
> [@Tripler](#): > > Interesting, I wonder if I can still transport firearms with my own lock–but that’s another thread topic of its own. I, like you, had a couple of instances where my _clearly marked_ Pelican cases were jimmied open, and the loss of a couple of my ‘prior occupation’s’ hand tools occurred. I’ve had people tell me that if they want to transport something valuable in checked bags they also pack a firearm (declared) with it. Their assertion was that bags with declared firearms are given special security in baggage handling and random baggage handlers aren’t given unrestricted access, ---
**Author:** ![Duckster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duckster/32/1244_2.png) [@Duckster](https://boards.straightdope.com/u/Duckster)\ **Post date:** [October 13, 2021, 3:37am UTC](https://boards.straightdope.com/t/should-i-be-concerned-that-websites-keep-track-of-old-passwords/952309/20 "2021-10-13T03:37:05Z")
> [@Tripler](#): > > Don’t get me started on the three random security questions. 🙄 > > Tripler Regardless of the random questions being asked, just respond with anything you will remember.