[Nogwater]

I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form <pw><pw> if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.

[oxryly1]

So, in other words, this is an elaborate prank?

[tlrobinson]

It's a moderately aggressive way to get people to change their passwords (more aggressive than an email or prompt, less aggressive than forcing upon login)

[oxryly1]

If that happened to me I'd just keep the doubled password. It seems more secure (it's not), and I already remember it.

This approach just seems dumb.

[StavrosK]

This would break passwords like "foofoo", since they'd think it was already doubled, they'd check "foo" against the hash and it would fail. Then again, you can get around that with doubling it again after checking, so I don't know.

[azernik]

Why is this a problem? If your password is "foofoo" and was set after the cutoff, then it won't be halved; if it is "foofoo" and was set before the cutoff, it will be halved, and then not match the password in the database, as intended.

[rafekett]

this, i'm not sure why it is hard to see that this is easy to implement without storing passwords in plaintext.

[StavrosK]

You have to have stored the last password change date, which many systems don't do.

[jtheory]

If they didn't before, they can start storing it to implement this.

[semanticist]

Passwords prior to the doubling were a fixed length, so they could always assume the first eight characters of a 16 character password (which hasn't been changed manually) is the original password.

Of course, anyone who has a leak of the original passwords can equally just send a a double of it, so I'm not sure what benefit this is supposed to be offering.

[cheez]

Yep, basically:

    if(userHasUpdatedPw) { checkPw(hash(pw)) }
    else{ checkPw(hash(pw+pw)) }

[saifelse]

More like:

    if(userHasUpdatedPw) { checkPw(hash(pw)) }
    else{ checkPw(hash(assertDoubledAndTakeHalf(pw)))}

[cheez]

Probably

[Aldo_MX]

  "password123password123".match(/^(.+)\1$/)[1]

[pwr22]

Oh God...