Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • Actually, I like your solution better, yes. Just say "you entered an incorrect password, by the way your password was recently changed" but display that same message for all incorrect passwords. Commented Feb 9, 2011 at 15:39
  • An old password notification definitely leads to a vulnerability. At this point an attacker would know a possible username or email associated with the account and that their password attempt is a password that the user uses...now just to find where else they have accounts and find the matches on the passwords. Most people reuse passwords... Commented Oct 4, 2013 at 14:51
  • @Rig: attackers should be your least concern because it is equivalently hard to try out the old password and the current password. The main concern should be users who accidentally typed a wrong user name and a wrong password that happened to be yours, and the user must be curious enough to decide to dig deeper about your account, now calculate the odd. Commented Oct 4, 2013 at 15:55
  • Never said it is a gross vulnerability but it is one even if it is on the slight side of things. Commented Oct 4, 2013 at 18:17