2

I need to rewrite our password change dialog currently. It's designed to check whether the old password differs from the new password.

  1. Old password: something
  2. New password: something
  3. New password repetition: something
  4. Click on "Save" leads to error: New passwords needs to be different from old password

Is this really necessary and why?

2
  • If the user does not want to change the existing password, why would he needs to go for change password option? Jul 27, 2016 at 14:24
  • @BharathBony Think about the typical dad-user. He might be just overwhelmed by a sudden password change popup and hacks in his password three times cause it says "password" somehow. I mean that this behavior ("new password must differ from old") just confuses user who don't know what to do. Users who do know what to do however won't hack in the same password again anyway (or at least have a reason to do so).
    – OddDev
    Jul 27, 2016 at 14:28

2 Answers 2

1

There are a couple of things going on here.

If a user has chosen or been prompted to change their password it is usually for security reasons.

The requirement for a password that differs from the old one depends on the level of security you need to implement: In financial institutions they often require a password of more than 8 characters which must contain lower case, capitals, numbers and punctuation. When you need to change this (about once every three months) they expect a new password to differ by more than three characters and not match any of the last 6 passwords. Lower security applications may only require that at least 1 character changes and that the new password does not match the current password.

In terms of UX for handling the rejected passwords; I would suggest validating the new password as the user is typing or, at least when the user focusses to the 're-type' field. That way they are alerted to the issue before they waste time typing it out a second time.

1
  • 3
    Note that the 1 character difference is not detectable in a secure system. The passwords should be stored as hashes only, so the system can only test whether they are exactly equal to stored earlier versions. (I suppose if you require user to authenticate with their old pw on the same page you can check).
    – Peter
    Jun 27, 2016 at 12:46
-1

The reason why the old password field is shown is to validate you are the account holder.

The reason why the new password field is repeated twice is because the password fields are usually masked and the user cannot see what they are typing, so by asking twice you ensure there are no unintended typos (after all we are only human and make typing mistakes all the time).

4
  • 2
    That's common sense and doesn't address the question. My question was why we should force the user to differ the new password from the old one. If we wouldn't do it he just can set the new password to the old one.
    – OddDev
    Jun 27, 2016 at 12:27
  • Sorry - that wasn't clear in your original question. The reason why the new password has to be different from the old one is a security feature and is usually defined by your companies security policies. I believe there are national security standards in different countries which also specify best practice.
    – SteveD
    Jun 27, 2016 at 12:34
  • The security best practice for changing the password to something different is to prevent any future breach of hashes which could be brute forced broken.
    – SteveD
    Jun 27, 2016 at 12:59
  • 1
    "In my original question"? :) I haven't edited a thing. It's still the original question. Thanks for your input!
    – OddDev
    Jun 27, 2016 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.