Hello People of Security,
one of my accounts got attacked, so they(Provider) did expire my password. I'm currently not able to log into my account. So when I started an older PC of mine, I was still able to access all my data from that devices client and synchronize with the cloud data.
So after some initial testing, I figured that the client doesn't care about password changes and stays always logged in.
Now I wonder if this is considered a Security threat and I should submit a report or is it considered secure?
If it is secure to not care about password changes, is it still good for an account which got attacked?
If it is secure, please explain why. Since my feeling tells me there should at least be a re-authentication after password changes.
Thanks for any help.