0

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?.

Facebook, and other companies, are storing historical passwords of users. When you want to change a password to a previously used password, it gets rejected. This seems desirable to me because a password can be leaked (in combination with a username or email address) and that combination might have became insecure.

Nevertheless, I wonder if it is desirable that companies like Facebook store all our historical passwords (hopefully strongly hashed, salted and stretched and not encrypted like Adobe once did).

Shortly:

  1. Should all web applications implement such a security feature?
  2. Is it desirable that companies store our historical passwords?
  3. How long are you allowed to store/archive such information or how many recently used passwords are allowed or recommended to store?

marked as duplicate by tim, Michael, LvB, Matthew, Rory Alsop Jun 24 '16 at 22:53

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2

To answer your questions:

Should all web applications implement such a security feature?

This is just another good security feature to help the user so if the application can afford (resources not financially) to have this implanted in their system there is no reason not to.

Is it desirable that companies store our historical passwords?

Since most users in our days do not understand the importance of not having the same password added with a 123 when changing the password, this is important to force them to change the password to something different so increase security.

How long are you allowed to store/archive such information or how many recently used passwords are allowed or recommended to store?

Forever. Why do I say this?

If an attacker wants to hack a specific user he will be looking for OSint about the user all over the place and he might even try a password that was used years back by the same user. And since users tend to use the same passwords over and over again this is not good.

Not the answer you're looking for? Browse other questions tagged or ask your own question.