Checking password uniqueness

Very scary perspective!

[henry0]

I have a scary thought:

If I check for password uniqueness and if that password exists. Any message, redirect or whatever
could not 100% hide that a match exits.

Then if the user is on the wrong side .. Bingo! He/she knows at least the password.

How will you address that? (short of answering: "Don't check for it :)" )

[eelixduppy]

I usually check for both the username AND the password to match the corresponding values, and if there is any error, I echo an error message:

The username/password that you entered is incorrect.

That way they don't know which one is correct, if any :)

[mcavic]

So you want to check if someone's password is the same as another user? You're right that you can't, because then if they also had a list of your users, they could try every user with that password.

What's the harm in letting multiple users have the same password?

[vincevincevince]

The only reason I can think of for doing this is if the system uses passwords only - no usernames. The solution? Introduce usernames, or at least email addresses. Then the password no longer needs to be unique.

A subtle way of reporting uniqueness would be to implement checks that the word is not in the dictionary as well as checking for uniqueness. Then the error could read "I'm sorry, that password is too insecure". They would get that on dictionary words as well.

[henry0]

I use indeed both UN, PW and email as identifier
It just that it does not sound OK to have multiple same PW, the PW has to be unique
V V V introduced in his answer a nice subtlety, that I like.

[mcavic]

It is okay to have duplicates. Forcing the password to be strong is good, but you have to tell them why. For example, "Your password must be at least 6 characters with letters and numbers".

[henry0]

Exactly the way I have it set.