Fine until you run into the filter that prevents the new password from having any of the same substrings longer than some limit compared to the old one.

Which means that they're storing your password in plaintext somewhere.