5 ms·

My favorite is this transaction: I forgot my password. Can you send me a link? Sure, here you go. Pick a new password. Okay, CorrectHorseBatteryStaple. Sorr

My favorite is this transaction: I forgot my password. Can you send me a link? Sure, here you go. Pick a new password. Okay, CorrectHorseBatteryStaple. Sorry, you can't use an old password

danrocks 4y ago
Funny, sure. But you still can have the same transaction by hashing "CorrectHorseBatteryStaple" then comparing with the stored hash.
- the_af 4y ago
  I think the OP is arguing you can guess a (possibly) current password this way.
  - qup 4y ago
    Only if you guess it on the first attempt.
  - joezydeco 4y ago
    I'm just amused by the irony of forgetting my password, going through the reset process, then realizing I did remember my password. Except now I can't use it any more.
    - zargon 4y ago
      Does it not let you log in with your old password after requesting a password change? That seems even more problematic, since anyone can request you password be changed.
      - joezydeco 4y ago
        Sometimes it does, sometimes it doesn't. More annoyances.
cirrus3 4y ago
Old password detection isn't necessarily a sign of weak security, if they are doing it right, they are just comparing a hash of the new password to saved previous password hashes. It is probably debatable if it is better security to not save old passwords hashes at all to perform this check, or to let users re-use old passwords that may have been disabled since they are known to have been cracked.
- halostatue 4y ago
  It can also be done securely if you have a flag that, when a password reset link is redeemed, the password must be reset in order to log in. There’s a couple of steps needed to make that happen cleanly (such modification should not be done on the GET of the password reset, but on a POST after the password reset link, prior to testing the passwords against old passwords and other security mechanisms).
  - cirrus3 4y ago
    yep, all true... this is a solved problem on how to do it right. The fact that the OP finds this interaction funny leads me to believe they don't understand how it can be done correctly, which is scary.
    - leni536 4y ago
      The point isn't that this is not secure. It's just that it isn't more secure, when it prevents setting the current, active password. An attacker could already just log in with that password.
      - joezydeco 4y ago
        Exactly!
ar_turnbull 4y ago
would be a nicer UX if instead of "sorry" it was "great, your password hasn't changed as this was your old password. ps. you're now logged in, go do whatever you were hoping to do you rascal!"
- boring_twenties 4y ago
  It's not preventing you from changing it to the current password, it's preventing you from changing it to any of the previous N passwords where N is usually 3-10.
  - joezydeco 4y ago
    But sometimes N=0.
- vlovich123 4y ago
  It could be a password 3 passwords ago rather than the current one
- cirrus3 4y ago
  Depends on the reason the user could not login. If they really just forgot, then maybe that would nice UX... maybe. It could also be concerning to an unaware user that that somehow the site knew my old password (even though _we_ know they are just comparing hashes). If the login was disabled due to the site knowing the hash of the old password appeared in a rainbow table somewhere, it would be a terrible idea to just let them use it again.
Mountain_Skies 4y ago
An early version of TBBS didn't require usernames and the passwords had to be unique over all accounts. If you signed up for a new account and selected a password someone else already had, it would tell you so. You could then use that password to login as the other user. Obviously that wasn't very secure but probably was created with a small number of closely affiliated people using the system in mind.

My favorite is this transaction: I forgot my password. Can you send me a link? Sure, here you go. Pick a new password. Okay, CorrectHorseBatteryStaple. Sorry, you can't use an old password

danrocks 4y ago

Funny, sure. But you still can have the same transaction by hashing "CorrectHorseBatteryStaple" then comparing with the stored hash.

the_af 4y ago
I think the OP is arguing you can guess a (possibly) current password this way.
- qup 4y ago
  Only if you guess it on the first attempt.
- joezydeco 4y ago
  I'm just amused by the irony of forgetting my password, going through the reset process, then realizing I did remember my password. Except now I can't use it any more.
  - zargon 4y ago
    Does it not let you log in with your old password after requesting a password change? That seems even more problematic, since anyone can request you password be changed.
    - joezydeco 4y ago
      Sometimes it does, sometimes it doesn't. More annoyances.

cirrus3 4y ago

Old password detection isn't necessarily a sign of weak security, if they are doing it right, they are just comparing a hash of the new password to saved previous password hashes. It is probably debatable if it is better security to not save old passwords hashes at all to perform this check, or to let users re-use old passwords that may have been disabled since they are known to have been cracked.

halostatue 4y ago
It can also be done securely if you have a flag that, when a password reset link is redeemed, the password must be reset in order to log in. There’s a couple of steps needed to make that happen cleanly (such modification should not be done on the GET of the password reset, but on a POST after the password reset link, prior to testing the passwords against old passwords and other security mechanisms).
- cirrus3 4y ago
  yep, all true... this is a solved problem on how to do it right. The fact that the OP finds this interaction funny leads me to believe they don't understand how it can be done correctly, which is scary.
  - leni536 4y ago
    The point isn't that this is not secure. It's just that it isn't more secure, when it prevents setting the current, active password. An attacker could already just log in with that password.
    - joezydeco 4y ago
      Exactly!

ar_turnbull 4y ago

would be a nicer UX if instead of "sorry" it was "great, your password hasn't changed as this was your old password. ps. you're now logged in, go do whatever you were hoping to do you rascal!"

boring_twenties 4y ago
It's not preventing you from changing it to the current password, it's preventing you from changing it to any of the previous N passwords where N is usually 3-10.
- joezydeco 4y ago
  But sometimes N=0.
vlovich123 4y ago
It could be a password 3 passwords ago rather than the current one
cirrus3 4y ago
Depends on the reason the user could not login. If they really just forgot, then maybe that would nice UX... maybe. It could also be concerning to an unaware user that that somehow the site knew my old password (even though _we_ know they are just comparing hashes). If the login was disabled due to the site knowing the hash of the old password appeared in a rainbow table somewhere, it would be a terrible idea to just let them use it again.

Mountain_Skies 4y ago

An early version of TBBS didn't require usernames and the passwords had to be unique over all accounts. If you signed up for a new account and selected a password someone else already had, it would tell you so. You could then use that password to login as the other user. Obviously that wasn't very secure but probably was created with a small number of closely affiliated people using the system in mind.