New answers tagged

3

Why does the administrator need to know the new password? 2) is actually only a problem if the administrator provides a new password, but not if the temporary password is randomly assigned and communicated to the user by a medium which the administrator can not eavesdrop. Don't let the administrator select the password, and he can no longer get any ...


2

Why you don't make an exception for 2? I mean, if the administrator sets a new password, it doesn't do the verification process of the old passwords. Just sets the new password and flags it so it needs to be changed at next logon. That way you can be sure the administrator has no access to the historical password file. There is a small risk for the ...


1

a business requirement [...] stipulates that a user is not allowed to reuse a previous password. The user cannot reuse her own previous password, but it doesn't prevent a user to reuse a password of somebody else, isn't it? I mean, if Jack and Mary are changing their passwords and Jack types the previous password of Mary, it shouldn't return a error, ...



Top 50 recent answers are included