Hacker News Reader

Hacker News

Comment by joezydeco | Hacker News Reader

Parent Full thread

joezydeco

My favorite is this transaction:

I forgot my password. Can you send me a link?

Sure, here you go. Pick a new password.

Okay, CorrectHorseBatteryStaple.

Sorry, you can't use an old password

View on HN

An early version of TBBS didn't require usernames and the passwords had to be unique over all accounts. If you signed up for a new account and selected a password someone else already had, it would tell you so. You could then use that password to login as the other user. Obviously that wasn't very secure but probably was created with a small number of closely affiliated people using the system in mind.

Old password detection isn't necessarily a sign of weak security, if they are doing it right, they are just comparing a hash of the new password to saved previous password hashes. It is probably debatable if it is better security to not save old passwords hashes at all to perform this check, or to let users re-use old passwords that may have been disabled since they are known to have been cracked.

It can also be done securely if you have a flag that, when a password reset link is redeemed, the password must be reset in order to log in. There’s a couple of steps needed to make that happen cleanly (such modification should not be done on the GET of the password reset, but on a POST after the password reset link, prior to testing the passwords against old passwords and other security mechanisms).

yep, all true... this is a solved problem on how to do it right. The fact that the OP finds this interaction funny leads me to believe they don't understand how it can be done correctly, which is scary.

The point isn't that this is not secure. It's just that it isn't more secure, when it prevents setting the current, active password. An attacker could already just log in with that password.

Exactly!

Funny, sure. But you still can have the same transaction by hashing "CorrectHorseBatteryStaple" then comparing with the stored hash.

I think the OP is arguing you can guess a (possibly) current password this way.

I'm just amused by the irony of forgetting my password, going through the reset process, then realizing I did remember my password.

Except now I can't use it any more.

Does it not let you log in with your old password after requesting a password change? That seems even more problematic, since anyone can request you password be changed.

Sometimes it does, sometimes it doesn't. More annoyances.

Only if you guess it on the first attempt.

would be a nicer UX if instead of "sorry" it was "great, your password hasn't changed as this was your old password. ps. you're now logged in, go do whatever you were hoping to do you rascal!"

It's not preventing you from changing it to the current password, it's preventing you from changing it to any of the previous N passwords where N is usually 3-10.

But sometimes N=0.

Depends on the reason the user could not login. If they really just forgot, then maybe that would nice UX... maybe. It could also be concerning to an unaware user that that somehow the site knew my old password (even though _we_ know they are just comparing hashes). If the login was disabled due to the site knowing the hash of the old password appeared in a rainbow table somewhere, it would be a terrible idea to just let them use it again.

It could be a password 3 passwords ago rather than the current one

Reply on news.ycombinator.com