Why keep track of user password changes in web application?

Question

For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just reminding you that you "changed your password 10 months ago..." they go ahead and state "Was this you? Recover you account"

What is the reasoning behind this -- security-wise? If an attacker was able to change your password 10 months ago, is it logical for him to let you be able to recover your account afterwards? If they could change your password, it means they could change pretty much everything that the user can use to recover the account.

I think I am missing a point on why sites need to keep track of user password changes.

EDIT: The said situation occurs when a user enters a wrong password that was once his password. For example, a site would have an example passwords table with the following contents:

user_id | password  | changed
---------------------------------
1       | blah      | never
---------------------------------
1       | blah blah | 12.07.2017
---------------------------------
1       | no blah   | 31.01.2017
---------------------------------
2       | blah      | never

When the user with user_id = 1 tries to login with the password no blah, he would be reminded that he changed his password on 31.01.2017. But when he logs in with his current password blah, he would be logged in with no problem.

Answer 1

I think I am missing a point on why sites need to keep track of user password changes.

No website HAS to keep tracks of user password changes. It's just that some do. Keeping tracks of password changes allow several things :

1. Remind the user that he change his password. This is usefull if the password has been changed by someone else. If it's not you then you know you have to change it again right away ! (You don't have to be hacked personnally to have your password compromised. All you need is password reuse and a hacked service.)
2. Remind the user that he already has used a password. This ensure that you are changing your password for a real new one and not using a password that you might have changed because it was compromised.
3. Remind the user that it might be time to change his password.

Answer 2

Sometimes users change their password, and then forget that they changed their password. If a user tries to log in with what they think is the correct password, perhaps out of habit, sees "password incorrect", they will assume they simply mistyped and probably try again. Perhaps they'll continue trying the same password a few times until either they give up in frustration and reset their password, or end up locking themselves out of their account if that's something your website does.

If instead, after the first incorrect login, you present the user with a "hey, you changed your password last week" message, the user may remember to use the new password instead of the old.

This is especially useful for the common but completely insecure "use the same password but increment the number at the end every few months" method of working around overly restrictive password policies with required periodic changes.

Answer 3

Changing a password doesn't always invalidate existing sessions. An attacker that manages to change your password might leave your existing devices logged in. The ten months timeline is indeed silly, but asking a user whether a password change was intentional isn't totally unreasonable.

As ThoriumBR mentioned, tracking how often you change your password is sometimes just sites reminding you "hey, you haven't changed it in a while...", but honestly in most cases, if you use passwords both strong (not at al guessable/predictable and too long to brute-force) and unique (not used on any other sites or services), you shouldn't need to change passwords unless the site actually suffers a security breach. The old advice to change passwords regularly has largely been superseded by the advice to use extremely strong passwords stored in a password manager, so you don't need to memorize them, and in that case there's much less value in password rotation.