Regarding Google's password reset system

Question

If you've ever forgotten your password on Google, and you try and reset it, it asks you for the last password you remember

Does what you input besides your original password effect the next screen.

If it does, surely Google hashes its passwords so how can it check if a password is close.

Answer 1

Im am sure that Google does not store your plain password. They do (they have to, actually) store your password encrypted. When you enter your "previous" password, they encrypt it and compares to what they have stored in the DB.

Hope this makes sense.

Answer 2

Here is a possible explanation of how Google can do it (and how I would do it) without storing your old password unencrypted and also checking if you typed your old password with a small mistake (Ex: "passworf" instead of "password", 'd' and 'f' are one near another on the keyboard). It uses Hamming distance to check your old password typed.

If you typed "passworf", by using a Hamming distance of 1 it will hash all passwords that have 1 letter different and compare the hashes (note that it can only try keys one near another on the keyboard for optimization). There might seem a high number of possibilities, but actually there are not (example: 27 characters * password length without neighbour keys optimization). One of those possibilities will be "password" which will get matching hashes therefore you proved your identity.

This is just a simple explanation, from here many algorithms can be derived, optimized etc. I am not claiming that Google does it this way!

Here you can read more about Hamming distance.