Say my website contains 2 functions:
- Allow a user to change their own password
- Allow an administrator to change a user's password (the user must change again before they login)
Now let's say that there is a business requirement which stipulates that a user is not allowed to reuse a previous password.
In 1, it is ok to return a "You cannot reuse a previous password" message, providing the user has successfully authenticated themselves with their current password.
In 2, I need to prevent information leakage. The administrator should not be given information on a user's previous password. I have implemented this by returning a generic "Invalid password" message. However I think a smart user can still figure out that if an "Invalid password" message is being returned for a perfectly valid string, then something else is going on.
Is there any way around this or am I just being too fastidious? My first thought is that the solution is to remove 2, and add a Reset Password feature.
EDIT - I think there is a bit of misunderstanding of the problem. The problem is that the user may have used one of their previous passwords on another site (eg: Bank). Thinking a bit more about this, I'm not sure how much more problematic the "changing another users password" leakage source is than someone simply trying to brute-forcing the main login form...