3 ms·

Facebook's Wrong Password page has a bunch of weird behavior that, as a lay person, I disagree with. Entering an old password into Facebook will tell you as su

by csydas 10y ago

Facebook's Wrong Password page has a bunch of weird behavior that, as a lay person, I disagree with. Entering an old password into Facebook will tell you as such [1]. I can't really think of a practical attack for this towards facebook, but I'm really weary of any system that reveals information about passwords, even though I somewhat feel I'm being overly paranoid. Password recycling just seems to be too prevalent to allow me to ignore this, even though it seems impractical to me. I guess I just don't like that it reveals password information. Enough failed logins automatically sends a temporary login pin to the email on file. Again, I feel that in a practical sense this isn't a big issue since if you can get access to the email that has the login pin you also likely have access to the victim's machine that is already logged in, but it still feels like a weird practice to automatically generate temporary credentials without being asked. [1] - http://i.imgur.com/J7YTJqY.png http://i.imgur.com/J7YTJqY.png

tedunangst 10y ago
Confirmation of old password isn't such a big deal. If you are concerned that a password was shared with another site and not changed, the attacker has an easier test: use the password at the other site. On the other hand, major utility boost for users. "I KNOW this is my password!" Actually, it was your password before you changed it. "Oh right." I know I do this quite frequently. Enter password. (Wrong.) Guess I have to change it. Reset. (New password must be different than existing password.) My "new" password is the one I changed it to last time, before forgetting.
- philipodonnell 10y ago
  This happens to me with arcane password requirements that only tell you the requirements after you reset it. try various passwords -> "Invalid password" -> send reset password email -> click email -> "passwords require a special character AND a number AND an unprintable character" -> me: ooooh, its that one -> enter it -> "password already used" -> enter another password I'll definitely forget next time. There are websites I need so occasionally that I'm sure that I have never logged in without resetting my password.

by csydas 10y ago

tedunangst 10y ago

Confirmation of old password isn't such a big deal. If you are concerned that a password was shared with another site and not changed, the attacker has an easier test: use the password at the other site. On the other hand, major utility boost for users. "I KNOW this is my password!" Actually, it was your password before you changed it. "Oh right." I know I do this quite frequently. Enter password. (Wrong.) Guess I have to change it. Reset. (New password must be different than existing password.) My "new" password is the one I changed it to last time, before forgetting.

philipodonnell 10y ago
This happens to me with arcane password requirements that only tell you the requirements after you reset it. try various passwords -> "Invalid password" -> send reset password email -> click email -> "passwords require a special character AND a number AND an unprintable character" -> me: ooooh, its that one -> enter it -> "password already used" -> enter another password I'll definitely forget next time. There are websites I need so occasionally that I'm sure that I have never logged in without resetting my password.