Is accepting old passwords a bad policy?

Question

This question is inspired by an experience I had today with online banking, as follows. One year ago I opened an online deposit account. (Without naming the bank, I will say the company is currently a constituent of the Dow -- in other words, not a fly-by-night institution.) Earlier this month, they launched a redesigned web interface, and today was the first time I accessed my account since the redesign. I accidentally used the same password I used when I originally created the account. However, I had previously changed my password. The old password should not have worked, but it did!

Subsequently it became apparent they had associated my account with old information: They asked to send an activation code to a phone number I have long since abandoned, but which I used when opening the account. After opening the account, I had replaced the old phone number with a new one in addition to changing the password. So it would appear the bank reverted to my outdated personal information (ie, password and phone number).

People sometimes change their password because they believe their old password may have been compromised. But this countermeasure is ineffective if the institution will still accept an old password.

Is there any reason to believe a reputable bank would intentionally accept an old password?

Answer 1

Well, I can't comment on this story of your bank, but the answer to your overall question is that it's very stupid to accept old passwords, because then users have no way to secure their account if their password is ever compromised.

Answer 2

It's a bad policy. The reason people change passwords is security, if the old password still works; there's no point of changing it. What if my old password was revealed to someone else (can happen, especially with phishing). I'd want to change it, and make sure that the old password is useless.

An interesting thing to note is that many sites store old passwords. While knowing a couple does not guarantee ownership, it certainly strengthens your position when you're trying to recover a lost account.

Gmail also stores old passwords. If you enter an old password within a few months of changing it, it reports "You last changed your password X days ago. If this was not you, blah blah [link to account recovery]"

Answer 3

Is there any reason to believe a reputable bank would intentionally accept an old password?

The only reason I can see this happening is that they had a massive failure and have to load a backup. The thing is, this quickly becomes vastly unreasonable the older the backup used. Undoing the last few hours of password changes is reasonable if there is a massive failure that requires a restore. Redoing days (or in this case, months if not years) is in no way reasonable. Even in the worst possible case where not only do they need to restore the database, but their recent backups were also destroyed, they should still have backups stored in a physically separate location.

So no, even in the case where they need to use a backup, there is still no justification for the situation you describe.

Answer 4

Changing a user's password after a fixed amount of time is requested in order to keep the account reasonably safe if the authentication credentials are stolen or leaked. Hence, accepting previous passwords is an unsafe solution and should be avoided.

From what I grasped about the story, it seems a deployment error from the bank, where and old version of the database has been used instead of the most current one.

Answer 5

While I agree that it's a bad idea to do so, there is a reason one could allow the last password in an only slightly different situation. When accounts get locked for whatever reason (too many requests or not logged in in a long time) and the password has to be changed, there might be only a certain time you allow your users to use the old password from the locked account to be able to change it. There are mechanisms like that for example on AiX (maxexpired parameter). It stays a bad idea though, but thought I'd add this information, since that was the question.