When changning my password ive come across this below message a few times:

Your new password must be different from your previous password.

What is the rationale behind such implementation?

EDIT: Sorry I was not clear that this message comes when I forgot my password and used the "forgot password". My question is: from a security point of view, why is it necessary to check that my new password is different from the old one and why can I not use the same.

  • 1
    So you have actually changed the password? – billc.cn Sep 23 '16 at 14:53
  • 2
    If the goal is to make you change your password, it doesn't really work if you don't change your password, does it? – Xander Sep 23 '16 at 14:53
  • If you are clicking "forgot your password", then you didn't really forget your old password, seen as you forgot it? Lucky roll? – INV3NT3D Sep 23 '16 at 15:11
  • After all I did not forget it - it came back to me. – Muleskinner Sep 23 '16 at 15:12
  • 1
    They probably use the same underlying system to change a forgotten password as they use for regular password changing. It's also possible, if the site has a time limit on passwords, that resetting the password also resets the timer so it makes sense for them to make you choose a new password even for reset. – JAB Sep 23 '16 at 18:41

The rationale is that they want you to change your password. If you try to use the same password, you aren't changing your password. You're re-entering your password.

So, perhaps the question then is why do they want you change your password? They want you to change your password to limit the amount of time a compromised password is valid. Whether this is a helpful mitigation or a case of the cure being worse than the disease is subject to much heated debate, but this is the reason none the less and a fairly standard policy today as it has been for many years.

The thinking is that if you lose your credentials to an attacker, the attacker can then authenticate into the system as you. However, if you're required to change your password regularly, the attacker can only authenticate as you until your next password change, at which time he will no longer have your current credentials, and will once again be locked out of the system. If the system were to let you continue to use the same password, the policy would obviously be useless as the same credentials would continue to work indefinitely.

  • 1
    Based on the user's edit, it also happens when using the password reset feature offered for forgotten passwords, which shouldn't necessarily require the new password to be different from the old as the use cases are different. – JAB Sep 23 '16 at 18:43
  • If you lose your credentials to an attacker, he can usually change it himself and prevent you from changing your password ever again. – Pierre Gardin May 27 '20 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.