系统如何知道密码何时包含先前密码的部分内容？
可能是一个超级基本的问题。我知道许多在线服务都使用哈希密码和盐密码，而不是出于安全目的将它们存储为明文。我大学的门户网站要求学生每 6 个月更改一次密码。据我所知，该系统是基于Oracle软件构建的。
然而，我的问题是，系统如何知道我的 20 个字符长的密码（包含大写字母、数字和符号）何时包含与我尝试设置的新密码顺序相同的 3 个字符？如果密码经过哈希处理，算法不应该是单向的吗？或者系统是否有可能将明文密码加密并存储？那不是更不安全吗？
抱歉，如果问题很难理解。如果您需要我澄清，请告诉我。提前致谢！
Probably a super basic question. I know many online services hash and salt passwords instead of storing them as plaintext for security purposes. My university's web portal requires students to change their passwords every 6 months. From what I know, the system is built on Oracle software.
My question is, however, how does the system know when my 20 character long password (with capitals, numbers, and symbols) contains 3 characters in the same order as the new password I'm trying to set? If the passwords are hashed, shouldn't the algorithm be one-way? Or is it possible that system encrypts the plaintext passwords and stores them? Wouldn't that be less secure?
Sorry if the question is hard to understand. Let me know if you need me to clarify. Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您在创建新密码时需要输入以前的密码，系统可以直接比对它们。这甚至可以在客户端完成。
编辑
只有几种其他可能性
If you have to enter your previous password when creating a new one, the system can compare them directly. This could even be done client-side.
EDIT
There are only a few other possibilities
先前的密码表很可能已加密（可能使用 rot26）。
It is likely that the prevoius password table is encrypted (possibly using rot26).
系统只能检查新密码是否与旧密码完全匹配（比较哈希值）。如果它检查子字符串匹配，则密码可能以明文形式存储。
没有布埃诺。
编辑：当然，或者尼克说的话。
The system can only check if the new password matches the old password exactly (compares the hashes). If it's checking substring matches, the passwords are likely being stored in plaintext.
No bueno.
EDIT: Or what Nick said, of course.