I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt.
How can I implement a password history set (to prevent password reuse) in a case like this?
If I have the traditional 3 field password reset (enter current, enter new, confirm new) I could store the current one as I replace the old with the new. However, then I have the case of a forgotten password. My users could go and do an self-service auto reset and reuse their passwords over and over again.
The stored passwords would be encrypted, but with reversible encryption making them less secure.