News for hackers. Stuff that matters.
Re:Frequent reauth doesn't make you more secure by rocqua on Friday June 13, 2025 @02:12AM (#44266120)
No, you can do it safely. The idea is to have the password renewal process also ask for the previous password.

This means the password changing method doesn't need to store a plaintext password, but still has access to the old plaintext password when changing. It's still not a great idea, but that's because nagging your users will see them choose worse passwords.

Re:Frequent reauth doesn't make you more secure by _dark_matter_ on Friday June 13, 2025 @10:24AM (#44268806)
Oh so trivially bypassable by changing your password twice.