User can input old password as new

[slaFFik]

... when changing the password on /members/slaffik/settings/

Not sure this is a right decision. IMO we should check that they are different (old vs new)

[r-a-y]

That would require keeping track of passwords.

If we decided to do this, do we keep this as a user meta entry with an array of the older hashed passwords? This doesn't sound good from a security standpoint:
​http://resources.infosecinstitute.com/wordpress-password-hashes/

The default hashing algorithm can be cracked with brute-force.

[DJPaul]

I think slaFFik is saying you can complete this form by putting the same password in the "old" and "new" screens, and is suggesting we ought to displaying an error if the new password is identical. I think it's worth adding such feedback to the UI, or, surfacing WordPress' error messages if this is another one we are hiding.

[boonebgorges]

Yeah, assuming that DJPaul's interpretation is correct, let's do this. If this is about keeping password history, I say wontfix - this is WP territory.

[henry.wright]

Just to chip in with my two pennies worth...

If a member has changed their password, then that indicates either a) they had forgotten their old password or b) their old password had been compromised. If it's the case of the latter and at a later date the member again changes their password (this time to the old compromised password perhaps forgetting it was compromised in the past) then that could pose a security threat.

If remembering old passwords is a trivial thing to do then I'd opt for that approach.

[slaFFik]

In this ticket I meant exactly what Paul described.

[henry.wright]

@slaFFik cool :)

In that case, please see 6111.diff which checks if the user-submitted new password is different to the user-submitted current password. If they're the same then an error message is given.

[slaFFik]

Thanks for the patch!

Regarding different to in error message:

​http://www.oxforddictionaries.com/words/different-from-than-or-to

Perhaps, different from should be used instead?

[henry.wright]

You're right. "different from" is more commonly used. I blame my local dialect :)

See 6111.02.diff

[imath]

In 9628:

In user settings, make sure current password does not match new password

When the user is changing his password, it will display an error message if the new password is the same as the current password.

Props henry.wright

Fixes #6111

[imath]

We were too quick on the latest commit. The super admin do not have to specify his current password to change his password ( the "pwd" input is not set ).

As a result when a super admin changes his password from the user settings, we get a notice.

[imath]

In 9631:

Settings component: skip the check between new and current password for the super administrator

Fixes #6111