Disallow using the same password as before on reset
fjarrett opened this issue · comments
In an effort to keep passwords fresh, we should compare hashes to ensure the same password is not being used two times in a row.
If we really wanted to be serious about things, we could store the last X number of previously used hashes in user meta and never allow the same password to be used twice within that X range.
For now we will just check the previously-used password and not a historical list of previous passwords.