Re:Frequent reauth doesn't make you more secure
by rocqua on Friday June 13, 2025 @02:12AM
(#44266120)
No, you can do it safely. The idea is to have the password renewal process also ask for the previous password.
This means the password changing method doesn't need to store a plaintext password, but still has access to the old plaintext password when changing.
It's still not a great idea, but that's because nagging your users will see them choose worse passwords.
This means the password changing method doesn't need to store a plaintext password, but still has access to the old plaintext password when changing. It's still not a great idea, but that's because nagging your users will see them choose worse passwords.