4 ms·

That's unnecessarily complex. Just ask for the old password when doing an expiration reset. Validate the old one then compare that against the proposed new one.

• joshvm 9y ago
  Actually, that's a very good point - you did indeed have to submit the old and new passwords. I want to say that they checked against older passwords too, but I might be misremembering.
• gpawl 9y ago
  That doesn't help. Your new password might be the same as the twice-previous password.