Password Reuse in Disguise: An Often-Missed Risky Workaround

"Near-identical password reuse occurs when users make small, predictable changes to an existing password rather than creating a completely new one. While these changes satisfy formal password rules, they do little to reduce real-world exposure. Here are some classic examples: Adding or changing a number Summer2023! → Summer2024! Appending a character Swapping symbols or capitalization Welcome! → Welcome? AdminPass → adminpass Another common scenario occurs when organizations issue a standard starter password to new employees, and instead of replacing it entirely, users make incremental changes over time to remain compliant."

"Most organizations understand that using the exact same password across multiple systems introduces risk. Security policies, regulatory frameworks, and user awareness training consistently discourage this behavior, and many employees make a genuine effort to comply. On the surface, this suggests that password reuse should be a diminishing problem. In reality, attackers continue to gain access through credentials that technically meet policy requirements."

Near-identical password reuse happens when users make small, predictable modifications to existing passwords rather than creating new ones. These predictable variations often satisfy formal complexity rules but provide little protection against real-world credential attacks. Common examples include adding or changing numbers, appending characters, swapping symbols or capitalization, and minor case changes. Organizations that issue standard starter passwords can see employees incrementally modify them, preserving underlying structure. Such near-identical passwords frequently slip past security controls and enable attackers to gain access using credentials that technically comply with policy requirements. Poor user experience incentivizes memorable but insecure password patterns.

Read at The Hacker News