3 ms·

While I partially agree, letting an user deny the password change with the old password is pretty horrible in case the password was leaked. And if your dev forg

While I partially agree, letting an user deny the password change with the old password is pretty horrible in case the password was leaked. And if your dev forgot the password after the holidays, you're looking at 3 additional free days for him. I see your point, but a timeout is a suboptimal solution.

TacticalCoder 6y ago
> ... letting an user deny the password change with the old password is pretty horrible in case the password was leaked. That's a different threat: an attacker knowing your password. Well... How do websites that allow instant credentials resets by email typically deal with a password reset asked by someone who knows the current password? Instant change too ("enter your current password / enter your new password twice"). And the good guy is locked out of his own account. I don't see how it's worse than that.