Passwords

[dee at cca.UUCP]

How about hacking passwd so that when you change your password it first
checks that you are really changing it and that your new password is not
in a database of old passwords.  If you flunk that test, it does
nothing.  If you pass, it changes your password and adds your old one to
the database.  In time, combined with a few complexity and length
checks, it should make passwords pretty secure.  If passwords went stale
and stopped working if you didn't change them once every N months, it
would be even better.
						Donald Eastlake
						dee at cca-unit
						decvax!cca!dee