Ask for current password when changing password

[Viper007Bond]

Any thoughts on the idea of forcing users to enter their current password before being able to change their account's password? This would add a little security on the off-chance that someone gained access to a user's admin area (say if they stupidly ticked "remember me" on a public PC or something).

[markjaquith]

I don't think this buys us any additional security. Someone with such access could install a backdoor, create a new user, or do any number of other things to engineer future access.

[Viper007Bond]

Someone with such access could install a backdoor

Only if the user has their theme files writable.

create a new user

Oh, good point. Nevermind then.