3 ms·
Old password detection isn't necessarily a sign of weak security, if they are doing it right, they are just comparing a hash of the new password to saved previo
by cirrus3 4y ago
Old password detection isn't necessarily a sign of weak security, if they are doing it right, they are just comparing a hash of the new password to saved previous password hashes. It is probably debatable if it is better security to not save old passwords hashes at all to perform this check, or to let users re-use old passwords that may have been disabled since they are known to have been cracked.
- halostatue 4y agoIt can also be done securely if you have a flag that, when a password reset link is redeemed, the password must be reset in order to log in. There’s a couple of steps needed to make that happen cleanly (such modification should not be done on the GET of the password reset, but on a POST after the password reset link, prior to testing the passwords against old passwords and other security mechanisms).
- cirrus3 4y agoyep, all true... this is a solved problem on how to do it right. The fact that the OP finds this interaction funny leads me to believe they don't understand how it can be done correctly, which is scary.