cross-posted from: lemmy.dbzer0.com/post/53841273
Shitty way to force people to change their password. Only thing worse than this is using your email login and getting an error, requesting a new password and getting an error that the account does not exist, then trying to make a new account and being told that the account is already in use.
JackbyDev@programming.dev 1 hour ago
I think what happens is that your password is expired but rather than telling you it says it is incorrect. This way it doesn’t leak what the current but expired password is.
bitchkat@lemmy.world 2 minutes ago
Same reason why you shoukd not validate username independently from password.