Timeline for Should I log that a user changed their password?
Current License: CC BY-SA 4.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 3, 2018 at 14:30 | comment | added | edruid | @Snake An admin can set passwords as a part of importing batches of users with passwords sent from the school (I know this is an insecure way of doing things, but some schools require us to do this...) | |
| Jul 3, 2018 at 5:46 | comment | added | Anemoia | Why does an admin need to change the password to log in as user? No assume functionality? | |
| May 16, 2018 at 23:23 | comment | added | Jon | If someone else is capable of changing a user's password, that action should be logged - if for no reason other than to offer support to confused users. | |
| May 16, 2018 at 9:03 | history | edited | edruid | CC BY-SA 4.0 |
added 424 characters in body
|
| May 15, 2018 at 23:24 | history | edited | forest | CC BY-SA 4.0 |
deleted 2 characters in body
|
| May 15, 2018 at 21:10 | answer | added | Sentinel | timeline score: 2 | |
| May 15, 2018 at 17:08 | answer | added | Ghost8472 | timeline score: 2 | |
| May 15, 2018 at 16:35 | history | tweeted | twitter.com/StackSecurity/status/996428868306251777 | ||
| May 15, 2018 at 16:34 | history | edited | edruid | CC BY-SA 4.0 |
Clearified the answer for the password expiration question.
|
| May 15, 2018 at 15:43 | history | edited | edruid | CC BY-SA 4.0 |
added 498 characters in body
|
| May 15, 2018 at 15:25 | vote | accept | edruid | ||
| May 15, 2018 at 14:36 | answer | added | Sangam Belose | timeline score: 5 | |
| May 15, 2018 at 14:28 | comment | added | BgrWorker | as @msanford says, the fact that password expiration rules exist and are even recommended in some scenarios suggests that there are no downsides in storing the time of the last password change | |
| May 15, 2018 at 14:16 | comment | added | Noir | Not only log it but make sure to inform the user that this change happened. This might help a user to detect that something unwanted is happening. Of course this only makes sense when the notice is send via an uncompromised channel. | |
| May 15, 2018 at 14:15 | answer | added | Shane Andrie | timeline score: 51 | |
| May 15, 2018 at 13:43 | history | edited | Anders |
edited tags
|
|
| May 15, 2018 at 13:19 | answer | added | workoverflow | timeline score: 9 | |
| May 15, 2018 at 13:08 | comment | added | msanford | Also, do you have password expiration rules? (If so the answer is likely obvious.) | |
| May 15, 2018 at 13:07 | comment | added | Tom K. | What is your expected gain from this? Who would have access to these logs? About what kind of accounts are we talking about? | |
| May 15, 2018 at 13:03 | history | asked | edruid | CC BY-SA 4.0 |