4

Consider this use-case for an enterprise social network. Users have already signed up but after some time, the admin for the network decides to apply a password policy.

  • Does applying a password policy force logout users or should they remain logged-in until they login the next time. In this case, if they've checked the Remember my login setting then they may never be signed out. So is it better to just force log out everyone?
  • If an existing user has a password that matches the newly applied password policy or if the existing user's password is even better than the applied policy, should the user be prompted to change their password anyways? Consider the limitation that a user's password information is not known to the system.
Improve this question
1
  • 2
    "If an existing user has a password that matches the newly applied password policy" This isn't something that you should be able to check.
    – Joshua Taylor
    Apr 15, 2016 at 14:36

2 Answers 2

Reset to default
8

A good password system relies on hashing (1-way encryption) and so cannot check to see if existing passwords comply with rules about criteria (video here:https://youtu.be/yoMOAIzBSpY and here: https://youtu.be/8ZtInClXe1Q)

1) Roll out validation checks based on new criteria for any new passwords created.

2) Email all users telling them that the criteria for secure passwords will change in 1 month and advising them to check that theirs complies and how to change it ahead of time. Those users that do so will have to face the new validation check for their new password.

3) Three weeks later, email those that haven't changed passwords (by checking account activity for password changes) telling them that they need to change their password to comply with new security measures and that they now have 1 week to do so.

This should deal with the majority of your users.

4) On the day you change over fully to the new criteria, force log out anyone left and push them through a "change password" tunnel when they log back in (bear in mind that this could potentially be years after they last used your site - you may also need to add a policy covering dormant accounts).

The forced log out should be the last measure but will be necessary if you intend to maintain a secure system. It's not a nice thing to do to users who've opted to stay logged in but it's the only way to force those last few users to adopt the new criteria for passwords.

Signalling the intention to change and allowing users to do so in their own time is a great way to let your users feel that they are still in control of their own account.

Improve this answer
4
  • OP will need to keep the old password database and associated features up for those dormant passwords for the foreseeable future (unless he wants to completely ditch those sleeper users) because he still need the old hashes to validate their passwords.
    – Mindwin Remember Monica
    Apr 15, 2016 at 10:43
  • That's why I suggested they may want to introduce a policy to manage dormant users.
    – Roux Martin
    Apr 15, 2016 at 10:47
  • You are assuming that none of the users already chose a password which was strong enough for the new policy. If you decide to increase the minimum password length from 6 to 8 characters, that won't bother me because my password is already 32 characters long. But if you force me to change my password because you incorrectly assumed it was less than 8 characters, I am going to be annoyed with you.
    – kasperd
    Apr 15, 2016 at 13:55
  • As I said at the beginning, a secure password system cannot check that your password complies with the new criteria. And from step 2: "advising them to check that theirs complies". A secure system cannot pre-check who needs to change and who doesn't so you need to make ALL user check themselves and monitor the resulting account activity to see who needs to be reminded a second time.
    – Roux Martin
    Apr 15, 2016 at 14:04
0

I would not log out users that are currently logged in. If I was visiting a site that suddenly logs me out, I would not appreciate that. You could show a prompt, but personally, I would do that at the next login attempt.

I would do these things to ensure the users update their password:

If you have cookies to remember me, I would set a new cookie value and check for that. If the value is not set, you know the user has not updated the password yet. At password update, set new cookie with that new value in it. OR check the expiry date. I prefer the new value. People could manually change the expiry date, but they do not know the new value you are looking for.

In the database, log the last password date. If the password has been updated after the start of the new policy, you know the password is ok. If the last date is older, then prompt the users to create a new password.

Allow the users to reuse their old password. If the password does meet the new policy, there is no reason to force them to pick something else.

Improve this answer
2
  • A note about the last paragraph: This does not mean you should have access to the password in any way, shape, or form. It means that, if their new password's hash matches the old one, you don't care as long as it fits the criteria.
    – anon
    Apr 15, 2016 at 11:49
  • Absolutely. I did not in anyway mean that there should be access to the password. However, if needed, previous hashed passwords could be stored if we would want to prevent users from reusing their password again, without having access to the unhashed version in anyway. I did not state this because that was obvious to me. I'm sorry for not being more clear.
    – LvS
    Apr 15, 2016 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.