Seems very reasonable to me. Similarly, I just had a friend comment that they like that Facebook tells them when they try to log in with an old password. But te

Seems very reasonable to me. Similarly, I just had a friend comment that they like that Facebook tells them when they try to log in with an old password. But technically that makes it less secure for people who reuse passwords (ie everyone, to a first order approximation).