3

When changning my password ive come across this below message a few times:

Your new password must be different from your previous password.

What is the rationale behind such implementation?

EDIT: Sorry I was not clear that this message comes when I forgot my password and used the "forgot password". My question is: from a security point of view, why is it necessary to check that my new password is different from the old one and why can I not use the same.

6
  • 1
    So you have actually changed the password?
    – billc.cn
    Sep 23, 2016 at 14:53
  • 2
    If the goal is to make you change your password, it doesn't really work if you don't change your password, does it?
    – Xander
    Sep 23, 2016 at 14:53
  • If you are clicking "forgot your password", then you didn't really forget your old password, seen as you forgot it? Lucky roll?
    – INV3NT3D
    Sep 23, 2016 at 15:11
  • After all I did not forget it - it came back to me. Sep 23, 2016 at 15:12
  • 1
    They probably use the same underlying system to change a forgotten password as they use for regular password changing. It's also possible, if the site has a time limit on passwords, that resetting the password also resets the timer so it makes sense for them to make you choose a new password even for reset.
    – JAB
    Sep 23, 2016 at 18:41

1 Answer 1

7

The rationale is that they want you to change your password. If you try to use the same password, you aren't changing your password. You're re-entering your password.

So, perhaps the question then is why do they want you change your password? They want you to change your password to limit the amount of time a compromised password is valid. Whether this is a helpful mitigation or a case of the cure being worse than the disease is subject to much heated debate, but this is the reason none the less and a fairly standard policy today as it has been for many years.

The thinking is that if you lose your credentials to an attacker, the attacker can then authenticate into the system as you. However, if you're required to change your password regularly, the attacker can only authenticate as you until your next password change, at which time he will no longer have your current credentials, and will once again be locked out of the system. If the system were to let you continue to use the same password, the policy would obviously be useless as the same credentials would continue to work indefinitely.

2
  • 1
    Based on the user's edit, it also happens when using the password reset feature offered for forgotten passwords, which shouldn't necessarily require the new password to be different from the old as the use cases are different.
    – JAB
    Sep 23, 2016 at 18:43
  • If you lose your credentials to an attacker, he can usually change it himself and prevent you from changing your password ever again. May 27, 2020 at 8:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .