

I presume that the code was tested for various cases where there was at least one previous password on record, but everyone forgot about new users with no previous passwords. However I’m having trouble imagining what the code could actually be doing.
I can only imagine a dynamically typed language, and a “checkedPasswords” variable being declared but uninitialized, then a loop incrementing that variable for each non-similar password pulled from the records, and finally a check to see if checkedPasswords equals the number of stored previous passwords.
The execution environment could type and initialize the variable by default after the first increment, but in the case of the user having no previous passwords on record that wouldn’t happen, and the final equivalency check would be comparing an integer to some internal “NaN” state, thus failing.




Yes, and you’ve got to remember to download it as soon as you buy it. I’ve been stung a couple of times by companies going out of business or inventing rationales for removing “old” things.