I found a www service that allows to change passwords but it is not allowed the password to old password I used before. Does this have any impact on security? I mean, will people generate passwords from a list where the next password can be easily guessed, like password1, password2, ... I think this might weaken security if a hacker gets previous passwords and tries to find some pattern from the passwords.
The impact is undefined. Choosing passwords that have a discernible sequence is an issue for sure in systems that require periodic password changes and disallow password re-use, however I'm unaware of any evidence that it is also an issue is system that merely allow password changes and disallow password re-use.
As with any system, the benefits and drawbacks offer trade-offs. There are certainly drawbacks, such as having to store old password hashes that could potentially be stolen and brute-forced along with current hashes. There are also theoretically potential benefits in that if previously used passwords that have been comprised can't be re-used, they can't give a malicious user additional attack windows.
Ultimately, the impact of this single control is minimal. It's unlikely to either help or harm security in any significant and meaningful way. It's far more important that users generate strong, unique password, don't re-use them across systems, and change them when compromise is suspected.
I'd say that it strengthens the security (at least a little bit).
Why? Because if you use the "change password" tool, you want to change the password. "Changing" the password to the password you had before is therefore not a useful behaviour of the application.
As long as you only check the new password against the last password (and don't compare it to any previous password), there are no downsides to this solution.
Why blocking reuse is bad in practice:
- User keeps having to generate new passes
- User runs out of easily memorizable passes and ends up using gibberish
- User can't remember gibberish and writes it down
- Someone sees it and swipes the user's account