0

I am working on a user registration page with AJAX. I noticed that users are able to create accounts which have the same passwords. How do I disable this?

If users want to create an account with the same username I do get an error message, why does that not happen for passwords?

Thanks!

  • 2
    Because then you would know that that password is used by someone else, and you could go through all the users until you find a match and log into their account. – KnutSv Dec 15 '16 at 12:25
2

This is not a common practice out of the box, and not even desirable as you may also imply that other users have the same password creating the possibility for this new user to just try different emails with that password.

What you could do is run via a plugin the user password against a list of weak passwords, and return a message if the password entered is easy to break.

If 2 or more users have the same password and their password is good, there's no reason for letting one of them know about the existence of the others. The same thought does not apply to emails or usernames though, since they are the unique ids within the system.

  • Thanks for your help, but I am wondering why do so many website have a 'this password is already in use' error message? – Branko Dec 15 '16 at 13:08
  • 2
    I think that error message indicates bad security practices by that web site. It's creating an attack vector for hackers. – John Morton Dec 15 '16 at 15:33
  • As i said before, and enforced by KnutSv and John Morton, it's not good practice letting the user know more than what is enough about the data (specially passwords and emails) contained in the DB. An error message saying the password is weak, asking he/she to choose another one is ok. But stay away from mentioning that another user has the same password. If you find that somewhere, it's an good indication that that site has weak security practices, as John stated above. – Gui Rams Dec 15 '16 at 16:32
  • Agree... definitely bad practice. – Brad Bell Dec 15 '16 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.