Are there any studies on the security of preventing password re-use in a single system?

Question

Some system, when you change your password, they don't let you re-use previous passwords. For example, you use password 1, then change it to password 2, and then when you try to go back to password 1, it blocks you.

Do we have any studies about whether this practice increases, decreases or does nothing to security?

I can think of arguments in either direction and none are conclusive without measuring. When I try to search for any studies on this matter, I only find articles about the danger to re-use passwords across systems, which is not what this is about.

Answer 1

I'm not aware of any scientific studies that focus specifically on the security impacts of password history controls.

However, it doesn't seem like we need a study to be fairly confident that reusing old passwords decreases security. An old password may not have been exposed during its use, but if it was exposed then reusing it provides an opportunity for an attacker to abuse it. So in some, likely small, percent of cases the choice not to maintain a blacklist of previous passwords is a detriment to security. In the cases where passwords remained unexposed it has a neutral impact on security.

Now if you expand the scope to include user behaviors that might be influenced by password history controls I could understand hypothesizing how this might negatively affect security. Maybe some user has tried to rotate between two very securely constructed passwords but when foiled by this control just decided to use a simple password and increment the number at the end after every change. You could argue that while rotating between two passwords is bad, using a simpler password that changes predictably is worse.

One problem is that the password history control is very often implemented in conjunction with scheduled password expiration, so password history can be difficult to study in isolation. You'd be left waiting to observe passwords changing organically. A user would have to decide to change their own password for some reason, or the app owners would have to force users to change passwords due to a security event. Then over time you could analyze whether being unable to use 'n' number of previous passwords had an observable influence on user new password choices.

This obstacle may be the main reason that researchers have chosen to focus more on the effects of password expiration controls or cross-site password reuse rather than password history. But I suspect it is also because most of us don't predict that there will be greater negative effects compared to the positive effects.