When a user wants to change the password for an account most web applications present a form where the user needs to enter the new password and the old password. So far I thought that I understood the benefits of this approach. For example, the old password is an additional mitigation to CSRF and it avoids account hijacking (i.e. change the password for an account) if an attacker gets the web session.
At Google - of course ;) - it is different. When the user clicks on the link to change the password a login form is presented and the user has to re-authenticate. After re-authentication a form is shown where the user just has to enter the new password. The old password is not required again.
There are some pros and cons with the approaches:
- Asking for the password right there where the change happens (first approach) has the advantage that the risk that weaknesses in the whole process can be exploited is greatly reduced. The new password and the old password are processed as a pair. If something goes wrong (e.g. an attacker is able to set an arbitrary user for the web session) then there’s the high probability that the old password still protects the password change.
- For the second approach (Google) there could be weaknesses in the process after re-authentication (e.g. CSRF protection could fail, bugs in session management).
- The second approach has the advantage that the application to change the password is not accessible before re-authentication. So weaknesses in the application are not accessible before re-authentication as well. Weaknesses which are not accessible cannot be exploited.
- Maybe Google wants to implement just one way for doing authentication. I think Google uses some kind of risk analysis for the login and that it could be possible that Google simply wants to use those mechanisms for the password change process as well.
In my opinion the risk for weaknesses in the second approach are much higher especially because there can happen a lot of things between re-authentication and submitting the new password. Also, I think that reusing risk analysis and stuff like that should be possible without great effort for a password change process as well.
So my question is do I miss something that makes the second approach (Google) superior?