For example, when updating a password on Facebook, they check to see if your new password is similar to your previous one by creating several variants of the new password, hashing them, and seeing if the hash matches any of your old password hashes.
[1] http://plaintextoffenders.com/post/68152196480/sos-state-tx-...
Also, users will just write down the password.
[1] https://www.schneier.com/blog/archives/2005/06/write_down_yo...
So letters + numbers + 3 special characters. Our first and last positions can't be special characters, and we can't have the same letters concurrently, so we're in the ballpark of:
62^2 * 64^6 = 264,157,668,573,184 passwords
However, passwords must contain a letter, number, and special character. This means that we can eliminate the entire letters + numbers set, the numbers + specials set, and the letters + specials set:
(62^2 * 64^6) - (62 * 61^7) - (10^2 * 12^6) - (52^2 * 54^6) = 2,261,873,997,098 - Did I get that math right?
That's still a decently large space, but it's small enough to be attackable even if the passwords are hashed.
Do many systems allow nearly unlimited attempts? Is this common on some platforms? For all except the most locked down users; single task; it pretty much is three strikes your out, call to fix your access.
You wouldn't be able to enforce "cannot be similar to the previous 8 passwords" like that, but they don't.
This poor guy.
