3

This is from the perspective of someone who had supposedly forgotten their password. We're doing this project wherein we "secure" an application that was given to us. We added this "forget password" feature that allows a user to change their password after providing answers to security questions. It was implemented in a way that follows most existing applications: if the given password happens to be the same as the current one, the user is notified "Password can't be the same as your previous password".

Why can't an application just let me "change" it and proceed or just direct me to the login page? I know that the user can just go to the login page themselves, I just need to know the reason for having to notify us this information.

4 Answers 4

1

If the policy of the company or the site is to ensure that passwords are indeed changed regularly, and passwords are not allowed to be reused, then password-changing functions include a check to see if the new password is the same as the previous one.

As for "why can't a password changing process simply switch over to a login process if the passwords are the same?" then that's a UX and a program logic flow question that isn't about security (I, personally, would find that strange and confusing as a user).

0

Why can't an application just let me "change" it and proceed [...]

Two reasons come to my mind:

  • because it can be a security requirement/policy; password changing is a common practice that tries to narrow the window of opportunity of a breach
  • in order to avoid cases where you've forgot your password, you haven't logged in in a while but your account is active; that means that someone else is using your account and, most probably, that person knows your current password. Which also means that you have to change the password in order to lock that other person out
0

I think you were given reasons why people do it but not why or whether it is necessary.

An example: I try to log in to site A and enter the password for site B several times. I can’t login so I do a password reset. Obviously as soon as a tap on “forgot password” I realise my mistake. As a user I would prefer in that order: Do nothing, my old password continues to work. 2. I set the password to the original value. 3. I’m forced to create and remember a new password. Either solution is safe, because nothing happened.

If someone resets the password because someone else might have learned it, then I’d expect the user to figure out that using the same password isn’t going to help. No reminder or refusal needed.

And then anyone could go to the website and press “forgot password”. As a user, I should be able to ignore this completely if the prankster doesn’t have access to my email or my messaging app. Under no circumstances should a prankster be able to make me change my password.

And a password reset message should assume that it might not have been the user causing it, so it should contain information. Like “if it wasnt you who tapped on “forgot password”then do this…”.

0

Passwords in some systems require to be changed regularly, due to possible database leaks, or more importantly, for your own security. You could have given away the same password you are using in another platform, not by your mistake, but by that system being compromised. Or someone could plant something similar to keylogger on your system to capture your used passwords.

You can get the most security by changing your password regularly on a platform. You don't end up using the same password on different platforms, hence if one is compromised then all of them can be. Also you giving less chance and time for attackers to figure out your password out and use them, from a leaked database. You can check leaked passwords from an application like password pwned checker.

For your question, it is about the architecture of the system, probably when you go and start reset password steps, your current password becomes an old password in the system. And the system will probably not allow you to use last n number of passwords due to reasons I told you above. So the application's database looks like this:

passwordHashed
oldpassword1Hashed
oldpassword2Hashed
oldpassword3Hashed

When you start restart password process, your password becomes, oldpassword1OneWaySalt and oldpassword3OneWaySalt pops from the list. So your password is waiting to be set. As I said, this is all about software design of the system. The programmer could design it many ways, how they see fit secure.

As a note after Ben Voight's and Ghedipunk's suggestion,

The best practice is to use stretched keys or irrevisible one way hashing algorithms, because if this practice is not done keeping multiple passwords belonging to a user in database can cause more trouble than it is supposed to in case of data breach; exposing all of them to an attacker.

7
  • -1 for suggesting that the database contains passwords.
    – Ben Voigt
    Jul 31, 2023 at 14:17
  • I don't understand your analysis @BenVoigt
    – C.Unbay
    Aug 7, 2023 at 9:15
  • Your answer claims that the database should contain the past passwords. This is a WORST practice. Even reversible encryption of passwords is unacceptable. Only one-way salted hashes should be stored.
    – Ben Voigt
    Aug 7, 2023 at 14:43
  • @BenVoigt, if you're going to be pedantic, then say that only stretched keys (results of PBKDF2, bcrypt, scrypt, Argon2, BALLOON, etc.) are acceptable. Salted hashes were obsolete for securing passwords in the 1990s.
    – Ghedipunk
    Nov 26, 2023 at 16:04
  • indeed both are to be added in this answer to make it fully right. thanks for the workaround
    – C.Unbay
    Nov 26, 2023 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .