3

This is getting common that while resetting one's password, web-applications force users not to use a password which they had used before. Just like forcing users to follow a particular pattern of passwords is a usability bug, restricting users not to use any of their previously used password seems to be equally problematic. Such approach compels the user to memorize more and more passwords but as a result, user would tend to use rather simple passwords which it could remember and recall or to go worse, write somewhere nearby for their reference.

My Question is: Do you consider this a usability bug that system doesn't let you use your previously used password?

My position is that applications should not only let you reuse your passwords but also let you keep your existing password in case you forgot one. But to be able to do that, user must

  • click a password reset link sent to his/her email (thus email is verified)
  • provide answer top secret question (authenticity of the user verified)
Improve this question

3 Answers 3

Reset to default
3

It depends on what the risks are.

As you've pointed restricting the user to only use new passwords means they have to memorise more passwords, etc. This adds a burden to the person using the system.

The advantage is that it puts a limit on the period of time a broken password can be active.

It also means that if an attacker succeeds in changing a password the original user will always know (because their old password doesn't work any more). This stops attacks that leverage resetting the password via one mechanism (be it bug or social hack) and then getting the original user to reset it.

Whether this is a burden worth carrying depends on what is being protected and why.

Both of the options you discuss have problems of their own. Attacking user's accounts via accessing their email is now a classic technique. Secret questions are just another password - and usually phrased in such a way as to make social hacks (or just Google) and effective tool.

Improve this answer
2

Scenario:

The company db was hacked and user information was stolen. The company is asking everyone to reset their passwords asap to limit any further theft using personnel ids.

  • In such a scenario, it is utmost important that the users DO NOT use the same password.

Same situation is also faced when someone has 'hacked' into your account. If you reset the password to the same thing, it is quit dumb on the system and user's part to allow the culprit easy entry by not changing the password.

Many systems go a step further and keep a record of your passwords for the past 6 months or some other period OR past 'n' number of passwords and do not allow you to use the same password. The reason being, like you mentioned, people do not want to memorize more passwords. So, what they do is, create a new password and reset which fulfills the systems requirement that it be not same as the previous password and the reset the new one to replace it with the old one again. Thus, being exposed to the theft again.

Improve this answer
3
  • There are three scenarios here. (1) Catastrophic (happens once in years): justifies password must be different from old one - agreed. (2) Account Hacked (may happen couple of times a year): justifies password must be different - agreed (3) I forgot my password: now this is where user should be dealt politely and shouldn't be forced to create a new password.
    – Salman Ehsan
    Commented May 27, 2013 at 0:35
  • @Salman If the user forgot their password, then, in reality there will be no scenario of 'not being allowed to use old password'.
    – rk.
    Commented May 27, 2013 at 0:38
  • This is exactly where I am asking that user should be allowed to use one of his old passwords and among among old passwords list, he may try to use the same password which he had used last time (and forgot). By doing that, we do not compromise on security aspects.
    – Salman Ehsan
    Commented May 27, 2013 at 2:20
1

This is simply a tradeoff between usability and security. Think of it almost in the same way that you think of insurance. You pay a little bit regularly to covers yourself from a large loss that will typically happen infrequently (if at all).

Requiring regular password changes in theory makes a system more secure. Not allowing old passwords to be reused is an obvious requirement of this, as if you reused old passwords, the result would be the same as not changing the password at all.

Now the UX question is whether this increased (theoretical) security is worth the usability hit that you will take by having it. And for that there is no absolute answer. Is it worth having this for your Reddit account? Not very likely. Is it worth having this for accounts that access hospital medical records? Very, likely, yes.

So this should be evaluated for each service and it should be decided from there.

That said, I have constantly referred to this as a theoretical security improvement, as it depends on the situation. If you're primarily trying to protect yourself from web based attacks then it is usually an improvement. But if you're trying to protect yourself from someone in the same building from getting access, it is usually worse as people tend to write their passwords down - even people that should know better. I've worked on a number of central servers in insurance companies where the admin password was written in the inside of the server cabinet.

So unless you educate users and are sure that they will not write their new passwords down, you actually will decrease on site security.

What you should be doing is requiring passphrases instead of passwords. They are easier to remember (less need to write down) and harder to break (if you avoid purely dictionary terms). Obligatory XKCD comic to explain this:

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.