Authenticating identity for password changes

A non-transitory computer-readable storage medium having stored thereon program instructions that are computer-executable to perform operations comprising:

• receiving, at a computer system, a user identifier associated with a user and a password update for the user identifier, wherein the password update includes a first password that has been successfully established as a current password for the user identifier, wherein the successful establishment of the first password as the current password causes the first password to replace a second password as the current password such that first password will authenticate the user and the second password will no longer authenticate the user;
• retrieving, by the computer system, a password preference model for the user identifier from a database, wherein the password preference model is provided from an entry in the database that corresponds to the user identifier, and wherein the password preference model was previously developed by the computer system based on one or more previous passwords including the second password, wherein the previous passwords were associated with the user identifier and successfully established as passwords to authenticate the user prior to establishing the first password as the current password, wherein the password preference model includes one or more elements generated based on the previous passwords and indicative of user tendencies in creating the previous passwords;
• updating, by the computer system, the password preference model responsive to the password update;
• and
• writing, by the computer system, the password preference model back to the database.

A method comprising:

• receiving, at a computer system, a user identifier and a first password, wherein the user identifier specifies a user, and wherein the first password is to replace a current password used to authenticate the user and, in the event that the first password is successfully established, will replace the current password such that the first password will authenticate the user and the current password will no longer authenticate the user;
• retrieving, by the computer system, a password preference model for the user identifier from a database, wherein the password preference model is provided from an entry in the database that corresponds to the user identifier, and wherein the password preference model was previously developed by the computer system based on one or more previous passwords successfully established as passwords to authenticate the user, wherein the password preference model describes one or more user tendencies in creating the previous passwords;
• determining, by the computer system, a similarity between the first password and the password preference model;
• and
• returning, by the computer system, a value indicating a likelihood that the first password was created by the user rather than a third party impersonating the user, wherein the value is based on the similarity.