1

For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just reminding you that you "changed your password 10 months ago..." they go ahead and state "Was this you? Recover you account"

What is the reasoning behind this -- security-wise? If an attacker was able to change your password 10 months ago, is it logical for him to let you be able to recover your account afterwards? If they could change your password, it means they could change pretty much everything that the user can use to recover the account.

I think I am missing a point on why sites need to keep track of user password changes.

EDIT: The said situation occurs when a user enters a wrong password that was once his password. For example, a site would have an example passwords table with the following contents:

user_id | password  | changed
---------------------------------
1       | blah      | never
---------------------------------
1       | blah blah | 12.07.2017
---------------------------------
1       | no blah   | 31.01.2017
---------------------------------
2       | blah      | never

When the user with user_id = 1 tries to login with the password no blah, he would be reminded that he changed his password on 31.01.2017. But when he logs in with his current password blah, he would be logged in with no problem.

2
  • It's more to remind the user that his password is too old and should be changed. If an attacker changed the user password, the owner would not be able to log back.
    – ThoriumBR
    Aug 26, 2018 at 20:12
  • Please have a look at the question again. I have added additional information that I think will shed more light on what I mean. Aug 26, 2018 at 22:09

3 Answers 3

1

I think I am missing a point on why sites need to keep track of user password changes.

No website HAS to keep tracks of user password changes. It's just that some do. Keeping tracks of password changes allow several things :

  1. Remind the user that he change his password. This is usefull if the password has been changed by someone else. If it's not you then you know you have to change it again right away ! (You don't have to be hacked personnally to have your password compromised. All you need is password reuse and a hacked service.)
  2. Remind the user that he already has used a password. This ensure that you are changing your password for a real new one and not using a password that you might have changed because it was compromised.
  3. Remind the user that it might be time to change his password.
1

Sometimes users change their password, and then forget that they changed their password. If a user tries to log in with what they think is the correct password, perhaps out of habit, sees "password incorrect", they will assume they simply mistyped and probably try again. Perhaps they'll continue trying the same password a few times until either they give up in frustration and reset their password, or end up locking themselves out of their account if that's something your website does.

If instead, after the first incorrect login, you present the user with a "hey, you changed your password last week" message, the user may remember to use the new password instead of the old.

This is especially useful for the common but completely insecure "use the same password but increment the number at the end every few months" method of working around overly restrictive password policies with required periodic changes.

0

Changing a password doesn't always invalidate existing sessions. An attacker that manages to change your password might leave your existing devices logged in. The ten months timeline is indeed silly, but asking a user whether a password change was intentional isn't totally unreasonable.

As ThoriumBR mentioned, tracking how often you change your password is sometimes just sites reminding you "hey, you haven't changed it in a while...", but honestly in most cases, if you use passwords both strong (not at al guessable/predictable and too long to brute-force) and unique (not used on any other sites or services), you shouldn't need to change passwords unless the site actually suffers a security breach. The old advice to change passwords regularly has largely been superseded by the advice to use extremely strong passwords stored in a password manager, so you don't need to memorize them, and in that case there's much less value in password rotation.

1
  • One of the security measures taken by such sites that are doing so well at keeping track of password changes is invalidating all sessions created before password reset so your first point... Also, I'm not sure if you completely understood my question. Let me edit the question to be more specific. Aug 26, 2018 at 21:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .