4

I was discussing with a non-IT friend after he came to me with a question regarding security and password change.

As he puts it: "Why do websites ask me to re-authenticate after a password change? I just provided both the old and the new passwords, I don't see why I need to put the new one again 2s after. Wouldn't it expose my password even more?"

I was surprised that something that seemed to me at first so mundane was.. well.. unknown to me, and I am wondering if there's a legitimate reason, or if this is an example of the monkeys story.

  • Is there any security requirement to enforce re-authentication after a password change?
  • If not for security, is there any other reason?

1 Answer 1

5

When changing the password, they kick out every logged-in account on every device by setting all cookies(remember me tokens) invalid and so closing all sessions on every device. This includes the device with which you were currently changing the password.

Some websites provide the option to change a password without kicking out all logged-in devices so that you dont have to reenter your password anywhere.

4
  • 4
    The latter is actually a really bad practice if it's not optional. It means that if someone steals a cookie of a user, then there is no way for the legitimate user to lock that person out of their account by changing passwords.
    – Philipp
    Aug 12, 2022 at 11:14
  • 1
    The second one is ofc optional, for example Microsoft offers you to either change your pw and kick every device or only change the pw without closing any sessions if your account didnt get hacked and you just want to change your pw Aug 12, 2022 at 11:22
  • 1
    I was certain that this habit was there before the notion of "connected devices" was a thing and was considering waiting for another answer. (I am talking about the information being shared with the users, last connection date, IP, location, ability to revoke each devices, etc.) While I still believe this is a new concept/feature, the concept of public/private computer was a thing back then, and I do believe forcing re-authentication was implemented to log off accesses made from public computers/log off attackers. Just sharing this tidbit if someone else has the same brain freeze as I did.
    – Yuriko
    Aug 18, 2022 at 8:20
  • You mean it was not originally invented in case your account got hacked, but for when you logged-in into your account on a public pc? Aug 18, 2022 at 13:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .