Recent changes to 2828: Master Password can be changed to the exact same password

#2828 Master Password can be changed to the exact same password

Rookiestyle — Sun, 10 Dec 2023 14:41:39 -0000

This patch will add following features:

FR 2848: Recommend to create a backup before the master key is changed. This option can be toggled in Options -> Advanced
FR 2828: Don't save and skip proposing an emergency sheet if old and new master key are identical.
This also prevents reusing the current master key if a master key change is forced

The attached file contains the patch and the german translation file

#2828 Master Password can be changed to the exact same password

Lukas Turek — Thu, 22 Jun 2023 05:42:52 -0000

Thank you, it would be greatly appreciated!

#2828 Master Password can be changed to the exact same password

Dominik Reichl — Wed, 21 Jun 2023 08:40:20 -0000

Ticket moved from /p/keepass/bugs/2258/

#2258 Master Password can be changed to the exact same password

Dominik Reichl — Wed, 21 Jun 2023 08:39:06 -0000

If this would be implemented, there would likely be users who make very minor modifications to the master password (e.g. appending a digit)...

Anyway, I could imagine implementing this as an option and thus am moving this to the open feature requests.

Thanks and best regards,
Dominik

#2258 Master Password can be changed to the exact same password

Paul — Wed, 21 Jun 2023 08:09:41 -0000

Why do you want to change the master password?
Using a long but easy to remember password and sticking to it is the best option.

Even NIST doesn't recommend it.
https://www.enzoic.com/blog/surprising-new-password-guidelines-nist/

cheers, Paul

Master Password can be changed to the exact same password

Lukas Turek — Wed, 21 Jun 2023 06:24:29 -0000

Hi everyone,

is there a possibility to add a MasterKey policy, which prevents people from using the same Master Password over and over again? For example a Master Key expires after six months and the user is forced to change it. Currently there´s no option (at least to my knowledge), to prevent users from replacing the expired Master Password with an identical new Master Password.

Thank you for your replies!
Best regards, Lukas.