This question already has an answer here:
Facebook, and other companies, are storing historical passwords of users. When you want to change a password to a previously used password, it gets rejected. This seems desirable to me because a password can be leaked (in combination with a username or email address) and that combination might have became insecure.
Nevertheless, I wonder if it is desirable that companies like Facebook store all our historical passwords (hopefully strongly hashed, salted and stretched and not encrypted like Adobe once did).
- Should all web applications implement such a security feature?
- Is it desirable that companies store our historical passwords?
- How long are you allowed to store/archive such information or how many recently used passwords are allowed or recommended to store?