Answers.Body: <p>This is not a common practice out of the box, and not even desirable as you may also imply that other users have the same password creating the possibility for this new user to just try different emails with that password. </p>
  
  <p>What you could do is run via a plugin the user password against a list of weak passwords, and return a message if the password entered is easy to break. </p>
  
  <p>If 2 or more users have the same password and their password is good, there's no reason for letting one of them know about the existence of the others. The same thought does not apply to emails or usernames though, since they are the unique ids within the system.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-12-15T13:08:06.250Z
Answers.Text: Thanks for your help, but I am wondering why do so many website have a  'this password is already in use' error message?
Answers.UserDisplayName: Branko
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-12-15T15:33:19.360Z
Answers.Text: I think that error message indicates bad security practices by that web site. It's creating an attack vector for hackers.
Answers.UserDisplayName: John Morton
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-12-15T16:32:35.640Z
Answers.Text: As i said before, and enforced by KnutSv and John Morton, it's not good practice letting the user know more than what is enough about the data (specially passwords and emails) contained in the DB. An error message saying the password is weak, asking he/she to choose another one is ok. But stay away from mentioning that another user has the same password. If you find that somewhere, it's an good indication that that site has weak security practices, as John stated above.
Answers.UserDisplayName: Gui Rams
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-12-15T23:18:25.800Z
Answers.Text: Agree... definitely bad practice.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-12-15T12:26:11.277Z
Answers.LastActivityDate: 2016-12-15T12:26:11.277Z
Answers.UserDisplayName: Gui Rams
Body: <p>I am working on a user registration page with AJAX.
  I noticed that users are able to create accounts which have the same passwords. How do I disable this?</p>
  
  <p>If users want to create an account with the same username I do get an error message, why does that not happen for passwords?</p>
  
  <p>Thanks!</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-12-15T12:25:03.807Z
Comments.Text: Because then you would know that that password is used by someone else, and you could go through all the users until you find a match and log into their account.
Comments.UserDisplayName: KnutSv
Tags: <users><registration>
Title: Don't allow multiple users with same the password
ThreadText: # Don't allow multiple users with same the password
  
  (Asked by: username_0 on 2016-12-15)
  
  I am working on a user registration page with AJAX.
  I noticed that users are able to create accounts which have the same passwords. How do I disable this?
  
  If users want to create an account with the same username I do get an error message, why does that not happen for passwords?
  
  Thanks!
  
  **Tags:** users, registration
  
  > **Comments:**
  > **username_1**: Because then you would know that that password is used by someone else, and you could go through all the users until you find a match and log into their account.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2016-12-15. Score: 2 | Accepted answer
  
  This is not a common practice out of the box, and not even desirable as you may also imply that other users have the same password creating the possibility for this new user to just try different emails with that password.
  
  What you could do is run via a plugin the user password against a list of weak passwords, and return a message if the password entered is easy to break.
  
  If 2 or more users have the same password and their password is good, there's no reason for letting one of them know about the existence of the others. The same thought does not apply to emails or usernames though, since they are the unique ids within the system.
  
  > **Comments:**
  > **username_0**: Thanks for your help, but I am wondering why do so many website have a  'this password is already in use' error message?  
  > **username_3**: I think that error message indicates bad security practices by that web site. It's creating an attack vector for hackers.  
  > **username_2**: As i said before, and enforced by username_1 and username_3 username_3, it's not good practice letting the user know more than what is enough about the data (specially passwords and emails) contained in the DB. An error message saying the password is weak, asking he/she to choose another one is ok. But stay away from mentioning that another user has the same password. If you find that somewhere, it's an good indication that that site has weak security practices, as username_3 stated above.  
  > **username_4**: Agree... definitely bad practice.  
  
  ---
  
  