3 ms·
> What if sites blocked passwords that have been used more than twice already? "I'm sorry, another user on this system is already using the password you have s
by RickHull 16y ago
> What if sites blocked passwords that have been used more than twice already?
"I'm sorry, another user on this system is already using the password you have submitted. Please choose a different one."
That's not the sort of information you want to be leaking.
- jberryman 16y agoMot to mention storing the passwords in plaintext (or unsalted) to be able to query them.
- rimantas 16y ago"Your password is too weak"
- RickHull 16y agoYes, this would suffice. But I think it points out that a duplicate password is just a proxy for a weak password: strong passwords tend to be locally unique. If you are going to have a strength requirement, then run your strength validation routine and deny weak passwords. That a password is duplicated seems like a special case of weakness that is not worth checking for. i.e. You probably don't want special checks for 'password' or '123456' either, since your strength validation routine should catch these.