Are there any security concerns with logging that a user changed their password? I'm already logging whenever an admin changes a users password for audit purposes, but is there a reason to not have a log of when each user changed their own password?
Edit: Answers to questions below
What is your expected gain from this?
Mainly forensic. The ability to see who (user_id of admin or self) changed the password in case the user claims they were hacked.
We are not using this to support any password managing schemes such as forced password change or disallowing password reuse.
Who would have access to these logs?
System administrators and possibly a small support team.
About what kind of accounts are we talking about?
User accounts on an e-learning platform i.e. teachers and students.
Also, do you have password expiration rules?
No. I'm talking about storing when every change of password was done, not only the last change.
What info are you storing? (not actually asked but implied)
We are storing the user id of the user whos password was changed, the user id of the user doing the change (it could be an admin or a students teacher), the time the password was changed and the URI used to change the password.
