[jasonj79]

A better way to do this would have been:

* hash current passwords with a salt, unique to each password entry, and throw away the plaintext entries.

* keep a history of hashes per user, to prevent changing to a past password

* ensure fair complexity of the incoming password

* once the deadline has been reached, force users who have not yet changed their password to do a password reset via an online form

* never, ever again think that doubling a password is a proper way to fix a security issue, ever...

[lukifer]

> ensure fair complexity of the incoming password

As we all know, a typical password validator formula is a great way to encourage people to choose "Secr3t!", or something else equally bad.

I'd really like to see a password field that auto-generated pass phrases using full english words from a sufficiently large wordset (in the vein of "correct horse battery staple"), possibly even enforcing such phrases as the only valid type of password. Every user gets a strong password they can actually remember. (...although possibly a non-starter for mobile contexts.)

[reitanqild]

Please don't enforce it. The moment you have a "sufficiently large wordset" in English you'd already added a whole lot of words that are hard to spell not only for non-native speakers.

Why not try to generate semi random pronounceable passwords? There's a clear decrease in entropy but brute force cracking against all pronounceable strings less than 20 chars will still be hard. (Of course your definition of pronounceability might differ.)

[ars]

> never, ever again think that doubling a password is a proper way to fix a security issue, ever...

I don't think that's it, I think it's just to annoy people into changing it.

[jasonj79]

I wondered the same, but I'm not sure that doubling my password would annoy me into changing it, especially when the password was previously capped at 8 characters.