The point isn't that this is not secure. It's just that it isn't more secure, when it prevents setting the current, active password. An attacker could already j

The point isn't that this is not secure. It's just that it isn't more secure, when it prevents setting the current, active password. An attacker could already just log in with that password.