Suppose that someone stole my password, he/she can easily change it by confirming the old password.
So, I am curious that why do we need that step and what is the purpose of using old password confirmation?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Two main reasons:
To augment the other answers, I'll add to confirm that the keyboard is working as the user intends.
Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will instead move the cursor left. Some interfaces show a warning, but many don't.
Most OSs have software keyboard layouts. Being able to type your old password correctly is good evidence that you're intent on using the current layout.
I've also had individual keys stop working, which causes frustration as you troubleshoot why you can't login from any other keyboard.
I think that confirming the old password doesn't help you secure your account in the case you lost your password. But It does make sense when no one has stolen your password, because it makes sure that you are the only one who can change your password (because only you know your password). For example, no one knows your Facebook password, but you've already logged in Facebook with your account on your cell phone, and then your friend borrows your phone. If he/she wants to change your password, it's impossible without knowing your current password.
It is to help you keep the account with yourself.
Your cookie is stolen by someone via a middleware or by some other methods, then if the site didn't prompted you for old password, they can change the Password and Recovery email and then the account no more belongs to you.
If someone has access to your system which you logged in, they can change the password and then recovery email and then the account no more belongs to you.