5

I found a www service that allows to change passwords but it is not allowed the password to old password I used before. Does this have any impact on security? I mean, will people generate passwords from a list where the next password can be easily guessed, like password1, password2, ... I think this might weaken security if a hacker gets previous passwords and tries to find some pattern from the passwords.

  • 1
    If the hacker can see password1, password2, and password3, and infer from this data that the current password is pasword4, what do you think said hacker is going to guess if the last 3 passwords are password password and password? – Cort Ammon Oct 31 '17 at 0:51
  • consider that; if you use a generic password (nearly same accross the many websites) when one of them is leaked you are protected on this www service does not let you choose old password but (of course) there are many different vectors may affect the security such as; how much this www service forces new password differs from the old one. – JackSparrow Oct 31 '17 at 6:53
  • "Your password was stolen! Everyone knows your password was '1234'! You must change your password!" "OK, please use password '1234', nobody will guess I didn't actually change it!" – Ben Nov 1 '17 at 14:07
4

The impact is undefined. Choosing passwords that have a discernible sequence is an issue for sure in systems that require periodic password changes and disallow password re-use, however I'm unaware of any evidence that it is also an issue is system that merely allow password changes and disallow password re-use.

As with any system, the benefits and drawbacks offer trade-offs. There are certainly drawbacks, such as having to store old password hashes that could potentially be stolen and brute-forced along with current hashes. There are also theoretically potential benefits in that if previously used passwords that have been comprised can't be re-used, they can't give a malicious user additional attack windows.

Ultimately, the impact of this single control is minimal. It's unlikely to either help or harm security in any significant and meaningful way. It's far more important that users generate strong, unique password, don't re-use them across systems, and change them when compromise is suspected.

2

I'd say that it strengthens the security (at least a little bit).

Why? Because if you use the "change password" tool, you want to change the password. "Changing" the password to the password you had before is therefore not a useful behaviour of the application.

As long as you only check the new password against the last password (and don't compare it to any previous password), there are no downsides to this solution.

-4

Why blocking reuse is bad in practice:

  • User keeps having to generate new passes
  • User runs out of easily memorizable passes and ends up using gibberish
  • User can't remember gibberish and writes it down
  • Someone sees it and swipes the user's account
  • ...or user gets fed up trying to memorize gibberish and puts it in a password manager where it belongs, and since it's gibberish it won't be guessed by online or offline cracking attacks. – Ben Nov 2 '17 at 17:42
  • Except this doesn't work with programs that the manager doesn't recognize. – user1258361 Nov 3 '17 at 0:19
  • 1
    Sure it does. Use a better password manager if it won't work with a program/website you need. Or in the worst case copy/paste from the manager or reveal it and type it manually. "Don't block password reuse because if you do, then people can't use trivial easily-guessed passwords" is probably the worst advice I've seen on this site. – Ben Nov 3 '17 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.