3 ms·
And users rotate their same "password1", "password2", "password3" passwords every expiration period...
by Akirus 7y ago
And users rotate their same "password1", "password2", "password3" passwords every expiration period...
- vectorEQ 7y agoits easy to let them type old password then new password twice, that way u can confirm it's not similar to old password atleast since u receive it in unhashed form from the user themselves.
- peterwwillis 7y agoYeah but you can't do anything about that unless you also enforce complexity. If the goal is to prevent defaults (ex. to prevent drive-bys), the above does that; "good" passwords is a separate requirement.