Penetration Testing: RE: Where are Windows "Enforce password history" passwords stored?

[<Wil.Allsopp () ins com>]

James Leighe [jamesleighe () gmail com] wrote:

> It's stored as a hash, so if you find out how to access them, you
> would have to crack it. So basically, it's not worth the time when an
> attacker could just go for the current password.

This shows a fundamental misunderstanding of security as well as the way
hackers think. There are many advantages for an attacker to have your
previous passwords - passwords are reused and some may be current on
peripheral or entirely separate systems.

Wil