News for hackers. Stuff that matters.

A comment on Frequent reauth doesn't make you more secure. Parent comment

Re:Frequent reauth doesn't make you more secure by account42 on Friday June 13, 2025 @04:48AM (#44266857)
Or just if they changed to a more secure hash algorithm themselves and want to upgrade users still on the older insecure one.
[ Parent | on HN ]
Re:Frequent reauth doesn't make you more secure by blueflow on Friday June 13, 2025 @05:46AM (#44267103)
This can be done at login time without the user noticing, as you have the plaintext password for a moment.
[ Parent | on HN ]
Re:Frequent reauth doesn't make you more secure by mooreds on Friday June 13, 2025 @10:13AM (#44268711)
Yeah, this is the best practice. We offer that in our product.

But it's possible that you could follow the best practice and still force a reset. This could be because:

* the customer or provider doesn't want to wait for everyone to log in

* they've waited for N months and now there is a block of users who have not logged in yet and they think it is worth the user annoyance to just force them all to reset their password

[ Parent | on HN ]
Re:Frequent reauth doesn't make you more secure by RealStickman_ on Friday June 13, 2025 @05:06AM (#44266946)
They could do that by comparing against the old hash and if it matches generate the new hash to store somewhere.
[ Parent | on HN ]