0

I am working on a user registration page with AJAX. I noticed that users are able to create accounts which have the same passwords. How do I disable this?

If users want to create an account with the same username I do get an error message, why does that not happen for passwords?

Thanks!

Improve this question
1
  • 2
    Because then you would know that that password is used by someone else, and you could go through all the users until you find a match and log into their account.
    – KnutSv
    Dec 15, 2016 at 12:25

1 Answer 1

Reset to default
2

This is not a common practice out of the box, and not even desirable as you may also imply that other users have the same password creating the possibility for this new user to just try different emails with that password.

What you could do is run via a plugin the user password against a list of weak passwords, and return a message if the password entered is easy to break.

If 2 or more users have the same password and their password is good, there's no reason for letting one of them know about the existence of the others. The same thought does not apply to emails or usernames though, since they are the unique ids within the system.

Improve this answer
4
  • Thanks for your help, but I am wondering why do so many website have a 'this password is already in use' error message?
    – Branko
    Dec 15, 2016 at 13:08
  • 2
    I think that error message indicates bad security practices by that web site. It's creating an attack vector for hackers.
    – John Morton
    Dec 15, 2016 at 15:33
  • As i said before, and enforced by KnutSv and John Morton, it's not good practice letting the user know more than what is enough about the data (specially passwords and emails) contained in the DB. An error message saying the password is weak, asking he/she to choose another one is ok. But stay away from mentioning that another user has the same password. If you find that somewhere, it's an good indication that that site has weak security practices, as John stated above.
    – Gui Rams
    Dec 15, 2016 at 16:32
  • Agree... definitely bad practice.
    – Brad Bell
    Dec 15, 2016 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.