Can I trust large companies like Google not to store failed password attempts?

Question

Let's say, for example, that I accidentally entered my Microsoft account password instead of my Google account password when logging in to some Google web service. After getting an error message, I entered the correct password. Since the connection is HTTPS, only the Google authentication service¹ should have "seen" my Microsoft password.

How badly do I need to change my Microsoft account password after this incident?² Is there maybe some kind of certification that those companies undergo that can give me some confidence that failed password attempts won't be logged?

---

¹ ...and, obviously, the NSA, but if they want to access my Microsoft account, they can just directly ask Microsoft.

² I am aware that changing passwords regularly is good practice, so let's pretend I'm asking purely out of scientific curiosity.

Answer 1

Nobody can ever tell you to trust or distrust some entity; you, yourself, will need to choose to trust this entity. You already trust Google not to load exploit code in your browser, you already trust Google by actually using their browser (Chrome), you already trust Google with your private conversations (GMail), your embarrassing search terms (yeah, they know what you like).

You see, whenever you have a question like this, simply think "Do I really matter?". The answer is most likely "No". You're nothing, you're a droplet in a sea of information. Every conversation you've ever had with anybody, every memory you have, every SMS you sent, every phone call, every email, every photo, all of them put together are less than 0.000000(a bunch more zeros)001% of the data Google and other big entities have and work with.

So, should you trust that Google will not store your failed password? I don't know. Should you trust that the NSA will not have access to that password? I don't know. But here's something I know for sure: The NSA don't really need your password to access your email, they simply tell Microsoft or Google "This guy... national security threat... send me all of his emails", that's it.

So, worrying about it doesn't matter very much. If you really feel like you should worry, then just change all instances of that password. Otherwise, don't think about it and enjoy your day.

Answer 2

It's a call you have to make for yourself, essentially, based on a few criteria.

As developers, we often encounter situations where we could reasonably easily insert malicious code, and the reason that the majority of us don't is that we're not complete dicks. In some cases, it would even be easy to make it seem accidental, and sometimes it would be easy to deliberately code in a weakness to exploit later. Hell, it's actually one of the biggest problems we face, having devs who can't avoid it.

So, whether or not you can trust them depends on essentially how paranoid your outlook is, and that will, like Adnan said, depend on who you are and what you're doing.

A somewhat useful point is that you can almost certainly trust Google, and the other big players, not to give your info to criminals, which is the real security threat. Being blackmailed by the NSA, FBI, CIA, MI5, Police, KGB or Stan Smith from American Dad is way less of a problem than being blackmailed by criminal groups. With access to your emails or something similar, most people could find something you wouldn't want reveal, and then it's just a matter of their morals as to whether they exploit that.

But very little of it will come down to passwords really, again like Adnan mentioned, a password isn't how most big agencies would go about accessing your information, they go through proper channels, that various laws have carefully allowed for.

I realise that I've mentioned a lot of the same points, but I hope I've also added some food for thought. It's a more complex issue than it seems on the surface.