(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing)

Scenario: You change your password to your Gmail/Yahoo email account on the computer using the website. You then go to your iPhone and attempt to pull up the built in mail app. Somehow it works, but only with the old password. You try deleting the account from the phone completely and then relogin and set it up. Nothing works. The old password stays logged in. So you test this. You observe that it takes roughly 1.5 - 2 weeks before the password change takes effect. Unfortunately you didn't try logging in with a new device to see what would happen, but it's easy to guess what might happen.

So now this all boils down to the root of it all: What actually causes this and is it a security issue? I know from having multiple accounts over the years and some requiring me to change the passwords regularly as a rule because it wasn't a personal email that this pretty much always occurs. I also know it isn't specifically me or my phone that is the cause. Multiple relatives have asked me for help wondering why they couldn't log in. I told them to try the old password and they said it worked. So it is definitely not local to just me or something I do with my phone. I don't have a random phone lying around to just test so I obviously cannot determine if this would happen with phones that were never logged in previously. However, all of this is an obvious issue if a password were ever compromised and a decent rule of security is to assume that any exploit such as this that any random Joe stumbles upon (and has to use it as a rule of thumb lest their be logged out for two weeks) has already been found and is being exploited by hackers.

Now I know that this is possible to be a thing in place due to a glitch as there is evidence of past passwords being saved in some systems for other reasons. Google used to save the past 100 passwords for a security feature. I found that while trying to see if this was mentioned or documented anywhere. I couldn't find it and that's more worrying. If nobody is aware of this issue then that makes it easier to exploit. Having full access regardless of password changes to someones email for roughly 2 weeks is definitely not something we need being prevalent. Anyways I'm mostly curious on what causes this if anyone is aware, if this has been documented,and what the extent of this issue actually is. For instance, an answerer testing to see whether or not a phone that was never connected to an email can login using the old password is probably critical to know here. It's the difference between a minor annoyance and... a major security issue.

Confirmed services that I personally know of to have the bug:

Gmail Yahoo (I will add more if any answerers confirm others)

  • 2
    I understand that the SE new ToS and whatnot put "New Contributor" on people for some reason. I specifically do not like this for the reason that I am NOT a new user of stack exchange and do not need to be treated differently simply because I posted on a subforum I haven't before. Thank you. I just wanted to get that out of the way before i get inundated with "welcome to __" posts. I do not like those..... – user64742 Aug 23 '18 at 5:18
  • It is a "work by design" known since 2014. Please snipped the part of your friend and relative feedback, it is not helpful for those who want to help to read your question. productforums.google.com/forum/#!msg/gmail/NeLaUNAE9NY/… – mootmoot Aug 23 '18 at 8:27
  • 1
    @mootmoot I just now tested with a new gmail account and I was able to log in using an old password and a phone that had never been logged into the account. If this is intended design then someone did something very very strange. – user64742 Aug 23 '18 at 12:09
  • @mootmoot and no, why should I be removing statements showing that I have done proper research which this site specifically requires? – user64742 Aug 23 '18 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.