or did you mean security.stackexchange.com/questions/36893/… ?

@Gilles yes this one and it's a duplicate of security.stackexchange.com/questions/19458/…

@TildalWave no, that's different

security.stackexchange.com/questions/36893/… is about storing passwords in cleartext

security.stackexchange.com/questions/19458/… is about keeping the hash

@Gilles yup damnit I obviously can't work on two things at the same time with you :P still, feels really familiar question, I'll try and find its better match

@TildalWave now that's a good one

the answers on the old questions don't explain things well, but Ori's answer does address similarity with older passwords, which I don't address

@TildalWave so, vtc?

@Gilles I think the most reasonable is to compute based on entry of both old and new password when change is required, then there are of course hacks like this where the old password isn't required, but that's a bit odd to me honestly, as it means a lot of overhead to calculate similarities like that

@TildalWave that's indeed the most reasonable way, but it doesn't work if you want to enforce that the new password is strongly different from all past passwords

@Gilles well the only other way that would be still considered safe password storage and make this possible on multiple previous passwords is if they use HSM, which I kinda doubt in this case, it's a school afterall... and I didn't read the questions as if they require different passwords from all previous ones... maybe it's some hybrid solution where they require previous and new password and compute on those on cleartext, and check against stored hashes of previous passwords directly

@Gilles hate to bring it to you but this one also seems terribly familiar: security.stackexchange.com/q/36833/20074 tho I can't find its duplicate due to hundreds of questions about passwords and hashing

@TildalWave I checked the classics and they don't present exactly the same point of view. But of course these are all variations on a theme

@Gilles well googling a bit now and it seems it's not an exact duplicate, which is rather surprising... I probably confused it with one of Jeff Atwood's blog posts

@TildalWave I hope our answers are better than Jeff's blog posts, he doesn't really grok security

Still need 20 more downvotes on security.stackexchange.com/questions/6095/… and 20 more upvotes on security.stackexchange.com/questions/6095/…

@Gilles well true but he's building a reference point for many developers with his blog, and some of it is pretty good, albeit maybe really not that good on the security side of things... still, pointing out what seems to me and your and all of us here self-obvious is still, sadly, news to most out there

@Gilles funny but I'm 100% certain I've already upvoted Thomas' answer there... maybe the system thought I'm one of his sockpuppets that day? :O