4

I've been trying to answer the following question but can't seem to find a clear answer...

When a user resets their password after forgetting it, should they be allowed to change it to the password that it's already set to?

I understand that the whole reason behind the user resetting their password is they forgot it, but in terms of security, wouldn't it make sense to have them change to a different password? In the Forgot Password Cheat Sheet and Authentication Cheat Sheet, I can't find any mention of reusing old passwords.

If this rule should be used, would this be a proper error message for it?

Password must be different than the existing one.

  • 2
    If a user forgets their password, goes to the password reset page and then remembers it, does this create a vulnerability? – immibis Mar 8 '18 at 10:12
4

I think the application of restricting users to reuse passwords will largely depend on the application and their risk acceptance. "Best practices" of passwords is probably one of most divisive topics in Information Security which is likely why those cheat sheets don't make mention of it.

For organizations that have a password policy that requires users to change their password every X days, restricting the user from changing their password to something it's already been makes sense. The logic behind this is that requiring users to change their password on a regular basis reduces the chance that an old password, if compromised, could be used in a Password Replay attack.

With such a policy, a "Remembered Passwords" value is likely set. This policy will remember the previous users X number of passwords to ensure that they are complying with the password policy and not re-using old passwords. The reuse of old passwords would effectively render the password policy useless. It is in this instance you would want to force a user to set a new password if they're clicking the "forgotten password" option. Without forcing them to do so, a user could just use the "forgotten password" function in your application to ensure they can always have the same password, without being forced to change it to something new.

Taking it one step further, it is also common for there to be a password "freeze" time where users cannot change their password for X days after it was changed. This is to prevent people from quickly cycling through 3 changed passwords to be able to utilize the one they like. This way if the password a user like expires, they can't quickly change their password X times to get back to the one they like.

EDIT : Take of this what you will, but NIST has issued a guideline recommending against password policies requiring users to change their passwords.

  • Important technical detail: "remember the user's previous X number of passwords" MUST be done without storing the passwords themselves. Store a history of the salt/hash entries and detect reuse by calculating using the stored hash and the new password (just like you do for a login attempt) – Ben Voigt Mar 8 '18 at 17:09
4

General rule of thumb: Most password policies are crap. They are based on ancient and never validated assumptions. Just this year had the bright example with the NIST standard that even made the mainstream news.

Forcing users to change passwords, either regularly or due to some event, also makes it more difficult for them to remember what the password was. Humans aren't good at variable handling. One very common cause of forgotten passwords actually is forced password changes, and a lot of help desk complaints are basically "I can't remember which it was", not a complete non-remembrance.

A change COULD be beneficial, as there's a reason the user forgot the password. Maybe it was chosen badly (hard to remember). But this should be a user choice.

One important consideration I almost always see missing is to account for the type and importance of your system from the user perspective. The rules for a system most users use every day should be different from one that most users use irregularly and/or with longer pauses between uses.

3

There are two reasons to change a password, per most recent NIST guidelines, which are slowly becoming the industry standard:

  1. The user does not like their current password.
  2. The current password has been compromised, or is suspected of being compromised.

Users can dislike their current password for a variety of reasons - They forgot it, it's hard to type, they think it's insecure, they like to rotate their passwords themselves, etc. If the user chooses to reset their password and sets it to the current password, there is no issue - these are what I call 'Usability resets' - they're not security related at all. If the user wants to reset their password to what it currently is, then who cares? It wasn't compromised so it doesn't matter if it's the same as it was.

On the flip side, If a password is compromised then it must be changed, and it cannot be changed to the same password.

In a system where you differentiate between user-initiated and administrator/system-initiated password resets, you can allow users to use the same password (or decline to reset), while enforcing password history requirements on administrative resets. Most systems don't do this and treat all resets under the strictest rules, but there is no security concern with allowing users to choose to reset non-compromised passwords to their current password.

1

To prevent a user from re-using old passwords means you have to at best, keep the old hashes around. From a security perspective, this can only decrease your password security since it increases the amount of information an attacker has. In the case of a breach of your password hash DB, this only makes the attackers job easier.

For example, It's not that uncommon for people to iterate passwords or re-use passwords. If you were to keep 5 old password hashes around, and the hashes are pa$$word1, pa$$word2, pa$$word3, pa$$word4, and pa$$word5, if the hashes were compromised you've now both increased the chances of cracking any single password by 5, and also increased the information on what the pattern for the active password is (obviously pa$$word6).

This has the added affect of decreasing security on other, unrelated websites where a user might re-use or recycle old passwords.

As others have pointed out, the rules surrounding passwords are based on voodoo, poor assumptions, and don't take the costs associated with them into account. Preventing users from re-using passwords is a good example of this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.