Wachtwoordinstellingen: "het wijzigen hiervan kan verstrekkende of onbedoelde gevolgen hebben voor uw site"

[BernardPaulus]

Dear Discourse Community,

On our self-hosted instance of Discourse, we’d like to increase the minimal count of unique characters, but we are faced with this scary warning:

Does this warning imply anything else than:

1. users with non-complying passwords will need to update them on next login
2. only the users with non-complying passwords will need to update them

?

I obviously searched before posting and read the OG blog post on Password Rules Are Bullshit

[ondrej]

Hey @BernardPaulus

After some research with Discourse AI it appears that:

• Changing the “Password unique characters” site setting will only enforce the new requirement for passwords set after the change.
  • Existing users with passwords that do not comply with the new requirement will NOT be forced to update their passwords upon their next login.
  • Accounts are NOT “broken” for existing users; they will still be able to log in with their current (possibly non-complying) passwords.
  • The stricter password rule will only be applied the next time a user changes or resets their password.

This answer seems to be backed up by this topic

Changing password requirements

Hello, I want to change our password requirements to 12 letters. Are legacy passwords affected, eg will users be prompted to change their passwords? Thanks in advance

[BernardPaulus]

hey @ondrej,

dat had ik gemist, dank je wel!

Om de post die je linkte te citeren:

De makkelijkste oplossing (voor jou) zou zijn om alle wachtwoorden te laten verlopen en iedereen ze opnieuw te laten instellen.