IT devs who wrote oldpassword===newpassword checks should be tarred feathered hung drawn and quartered, in that order.
Yeah! They should be checking a list of old hashes, so that none of the previous passwords can be used!
Nah, use a password manager and stop using that garbage collection of characters you’ve used for over a decade.
Password managers don’t protect against passwords being stored in plaintext on the server side… Which my main comment implies.
If I had to implement a same password check, I would simply check if the new password works to authenticate the user. If it doesn’t, then it’s different. There’s no reason or excuse to ever store plaintext passwords.
I’m no expert either but IIRC best practice is to use salting and hashing. basically together with your password is a long string of random characters generated by the site (the salt). the two are combined and put into a a cryptography hashing algorithm to give you a hash. the website only stores the salt and the hash. every time you log in you provide the password for the whole thing again and if the output hash matches the stored one then it knows your password is correct, without ever having to store it in any record.
They should also fire the ones who make it so the correct password fails when you enter it.
“we just had a breach and soft forcing users to change their credentials”
It legit pisses me off when a site has the gall to claim I forgot my password. My password manager did not forget!!
(enters “4”)
Notification: Your password has changeddeleted by creator
