The general opinion on password policies seems to be that complexity rules are counterproductive to security due to the human nature .
Does this also apply to password policies prohibiting the re-use of passwords that a user had on the same system? What are the actual benefits (or disadvantages) of preventing the re-use of e.g. the 3 most recently used passwords? Would it be "secure enough" to just prevent that the current and the new password are identical?
Following the gist of the answer linked above, I feel that if e.g. a specific system's user has to change his/her password every month with a password policy in place that prohibits the re-use of the 3 most recently used passwords, the user would just use the password used before the 3rd latest. Hence, cycling through a pool of 4 passwords instead of 3, adhering to the password policy but defeating the policy's purpose.
- The password must be remembered and typed by a human being. Password managers with CSPRNG-passwords are not feasible in this scenario.
- The policy to regularly change the password cannot be challenged