Yeah, this. There are sites for some maddening reason that don’t bother to tell you it’s time to change your password, they just force you to reset it without telling you why. Gotta be some kind of lazy shortcut to do it this way and not prompt the user that a password change is required.
It’s frustrating but it does give information to attackers. If an attacker just sees the login attempt was rejected, then they have no idea if it was because the password changed, the user entered it wrong in the phishing form, the user realized it was a phishing attempt and gave garbage to fuck with them, the password expired, or if the service provider is on to them.
If an attacker sees “your password has been reset and you must set a new one” then they have some information that could be used to social engineer their way into the account. Especially if it’s a work account where the email is behind the same password.
Maybe for some. Government sites that I use do this deliberately (not accept your current password) to make you change it. Pretty frustrating the first few times it happened, but now I know that when this happens it’s because of a password change requirement. It’s been years and they still haven’t just made a “time to change” prompt.
Yeah, this. There are sites for some maddening reason that don’t bother to tell you it’s time to change your password, they just force you to reset it without telling you why. Gotta be some kind of lazy shortcut to do it this way and not prompt the user that a password change is required.
It’s frustrating but it does give information to attackers. If an attacker just sees the login attempt was rejected, then they have no idea if it was because the password changed, the user entered it wrong in the phishing form, the user realized it was a phishing attempt and gave garbage to fuck with them, the password expired, or if the service provider is on to them.
If an attacker sees “your password has been reset and you must set a new one” then they have some information that could be used to social engineer their way into the account. Especially if it’s a work account where the email is behind the same password.
Maybe it was just time, maybe your password got scrambled because your account was compromised: They’ll never tell!
Maybe for some. Government sites that I use do this deliberately (not accept your current password) to make you change it. Pretty frustrating the first few times it happened, but now I know that when this happens it’s because of a password change requirement. It’s been years and they still haven’t just made a “time to change” prompt.
It’s pretty common in general but at least some of them actually do you the courtesy of letting you know.