Why does Facebook bother comparing old and new passwords?

Because if Facebook can algorithmically produce similar passwords, then so can a password cracker.

The sequence could go like this: Password compromised -> user changes it to something similar -> new password compromised algorithmically by trying similar passwords to known previous one.

Also, imagine a scenario where an account is being specifically targeted by an actual human being. The attacker may know previous passwords or have an idea what they roughly could have been (e.g. the account owner's ex romantic partner or something). In this case, a password that was similar to a previous one would be more likely to be guessed.

Tags:

Passwords

Hash