3 ms·
Another issue is that most password requirements change over time, without requiring existing passwords to be changed. There’s no way to tell what the requireme
by beokop 9y ago
Another issue is that most password requirements change over time, without requiring existing passwords to be changed. There’s no way to tell what the requirements were the last time the user changed their password without breaching confidentiality. Having a list of all previous requirement schemes would be a mess.
- ukd1 9y agoActually, it's pretty simple - each time you login, check that the password (now cleartext, as supplied by user) is valid AND meets the current requirement. If it's valid and doesn't, push in to a change password flow with the current requirements. If you're extra careful, you can expire older passwords and require an email reset before use.