This also happens when your password manager, for example, generates you a 24 character password which the registration accepted just fine but the login form inexplicably has a limit of 20 characters which has happened to me multiple times somehow.
We have this issue in an internal tool at my workplace. My coworker is the only one who has long enough password and is too stubborn to change it, so they change the (client side) limit every time they log-in.
It is a possibility, there are pages that scrape the dark web where you can check if your account and password are out there. But note that this means more information could be out there. This is not preventive it is informative.
It can also happen if you are using an old password. To prevent reuse of old passwords the hashes are remembered, if you attempt to reset the password to an old password you often get the exact same message.
I forget what it was but something I had an account on for a time forced you to change your password every 6 months and prevented you from reusing any from the last 5 years. It was ridiculous.
yep, I’m a sysadmin and we do this to people. We’ll invalidate their password by forcing a password change, but if you miss the password change window (it’s usually timelocked), their existing password will become invalid, and they’ll need to call us to have it reset, then they try to change it back to what it was but password history is on, so they can’t use any of the last x passwords (usually 3, but it can vary); and it’s interesting to watch them struggle to set a password that complies with complexity, length and history requirements. It usually takes 5-10 attempts before they find one that works.
As a sysadmin: no, I don’t know what your password is, they’re all hashed and salted on the back end. No, I don’t want to know what your password is, I don’t care, I can reset it at any time and override the locks we have on your files that only allow you to see your own data, and gain access to pretty much anything at any time. I have my own set of credentials that are admin level and I can do whatever I want with that. Related, unless asked, I don’t do anything regarding your data, since I’m too busy to bother snooping through whatever you have saved; this is also a moral and ethical problem, and can lead to me being dismissed if I do it without just cause. The only people with the authority to ask me to do that are basically the executives of the company and the police. Short of you being investigated for something you’ve done wrong on the systems I manage on behalf of a company, your data is private, with a very high level of probability that the privacy of your data will never be compromised unless you depart the company as an employee, in which case your email is probably going to get transferred to someone else, and/or your data will be exposed to find any relevant notes/files for ongoing projects that you were assigned.
Long story short: don’t do sketchy/illegal shit on work computers/systems. The systems are not yours and the data on them is entirely the property of your employer, regardless of how it ended up on the system. I get that you want pictures of your grandchildren or favorite pet as your desktop wallpaper, but you’re handing them rights to use those images if you put those files on your work computer. It’s EXTREMELY RARE that someone’s personal photos will be used for any reason, even if they’re found on a work system, but it’s not impossible. Let work be separate from your personal, and just leave the system as-is. Do your work and go home. If you really feel the need to have such photos, go to a photolab and print them off, put them in a frame and place them at your desk; that’s considered a personal effect and such items are still your belongings, and the company cannot take possession of them whether you work there or not. Don’t sign into personal email or accounts during work time, if you must, use incognito or private browsing, or be a normal, sane person and just use your personal cellphone.
This happens when the password requirements are changed or the password database has been leaked.
I will let you know that I’m extremely fun at parties.
You should have your own parties with more people like you. I’d go.
This also happens when your password manager, for example, generates you a 24 character password which the registration accepted just fine but the login form inexplicably has a limit of 20 characters which has happened to me multiple times somehow.
We have this issue in an internal tool at my workplace. My coworker is the only one who has long enough password and is too stubborn to change it, so they change the (client side) limit every time they log-in.
Omfg thank you.
Yes I use a password manager *now Kid me was a moron but it’s nice to understand what caused this finally.
This also happens when the user types the correct password but does not notice the typo in the username.
It also happens when the server side hash gets corrupted in the main password field, but not in the table containing previous hashes.
…wait, so it means my password was leaked??
It is a possibility, there are pages that scrape the dark web where you can check if your account and password are out there. But note that this means more information could be out there. This is not preventive it is informative.
Then it should just prompt you to change your password after login, not do this circular bullshit
It would be a security risk if the database was leaked.
It can also happen if you are using an old password. To prevent reuse of old passwords the hashes are remembered, if you attempt to reset the password to an old password you often get the exact same message.
I forget what it was but something I had an account on for a time forced you to change your password every 6 months and prevented you from reusing any from the last 5 years. It was ridiculous.
i don’t like being in the world where solving peoples inconveniences that are easily solved is seen as bad
my friends are like noo let me just be angry and im like why its clearly pissing you off and 3 clicks will fix it
yep, I’m a sysadmin and we do this to people. We’ll invalidate their password by forcing a password change, but if you miss the password change window (it’s usually timelocked), their existing password will become invalid, and they’ll need to call us to have it reset, then they try to change it back to what it was but password history is on, so they can’t use any of the last x passwords (usually 3, but it can vary); and it’s interesting to watch them struggle to set a password that complies with complexity, length and history requirements. It usually takes 5-10 attempts before they find one that works.
As a sysadmin: no, I don’t know what your password is, they’re all hashed and salted on the back end. No, I don’t want to know what your password is, I don’t care, I can reset it at any time and override the locks we have on your files that only allow you to see your own data, and gain access to pretty much anything at any time. I have my own set of credentials that are admin level and I can do whatever I want with that. Related, unless asked, I don’t do anything regarding your data, since I’m too busy to bother snooping through whatever you have saved; this is also a moral and ethical problem, and can lead to me being dismissed if I do it without just cause. The only people with the authority to ask me to do that are basically the executives of the company and the police. Short of you being investigated for something you’ve done wrong on the systems I manage on behalf of a company, your data is private, with a very high level of probability that the privacy of your data will never be compromised unless you depart the company as an employee, in which case your email is probably going to get transferred to someone else, and/or your data will be exposed to find any relevant notes/files for ongoing projects that you were assigned.
Long story short: don’t do sketchy/illegal shit on work computers/systems. The systems are not yours and the data on them is entirely the property of your employer, regardless of how it ended up on the system. I get that you want pictures of your grandchildren or favorite pet as your desktop wallpaper, but you’re handing them rights to use those images if you put those files on your work computer. It’s EXTREMELY RARE that someone’s personal photos will be used for any reason, even if they’re found on a work system, but it’s not impossible. Let work be separate from your personal, and just leave the system as-is. Do your work and go home. If you really feel the need to have such photos, go to a photolab and print them off, put them in a frame and place them at your desk; that’s considered a personal effect and such items are still your belongings, and the company cannot take possession of them whether you work there or not. Don’t sign into personal email or accounts during work time, if you must, use incognito or private browsing, or be a normal, sane person and just use your personal cellphone.
Oof I have colleagues that use the company phone as their personal and will not buy their own.
Classic mistake.