Let's say, for example, that I accidentally entered my Microsoft account password instead of my Google account password when logging in to some Google web service. After getting an error message, I entered the correct password. Since the connection is HTTPS, only the Google authentication service¹ should have "seen" my Microsoft password.

How badly do I need to change my Microsoft account password after this incident?² Is there maybe some kind of certification that those companies undergo that can give me some confidence that failed password attempts won't be logged?


¹ ...and, obviously, the NSA, but if they want to access my Microsoft account, they can just directly ask Microsoft.

² I am aware that changing passwords regularly is good practice, so let's pretend I'm asking purely out of scientific curiosity.

  • Maybe this is a stupid question but... Why would a Web service store failed login attempts? Useless data in the database – molmaster12 May 2 '16 at 23:56
  • 1
    Many servers log failed login attempts. – schroeder May 3 '16 at 1:17
up vote 12 down vote accepted

Nobody can ever tell you to trust or distrust some entity; you, yourself, will need to choose to trust this entity. You already trust Google not to load exploit code in your browser, you already trust Google by actually using their browser (Chrome), you already trust Google with your private conversations (GMail), your embarrassing search terms (yeah, they know what you like).

You see, whenever you have a question like this, simply think "Do I really matter?". The answer is most likely "No". You're nothing, you're a droplet in a sea of information. Every conversation you've ever had with anybody, every memory you have, every SMS you sent, every phone call, every email, every photo, all of them put together are less than 0.000000(a bunch more zeros)001% of the data Google and other big entities have and work with.

So, should you trust that Google will not store your failed password? I don't know. Should you trust that the NSA will not have access to that password? I don't know. But here's something I know for sure: The NSA don't really need your password to access your email, they simply tell Microsoft or Google "This guy... national security threat... send me all of his emails", that's it.

So, worrying about it doesn't matter very much. If you really feel like you should worry, then just change all instances of that password. Otherwise, don't think about it and enjoy your day.

  • 1
    +1 for the answer. I just disagree with the "there's no point of this question.". If there was no real point, and still you had answered, you could, perhaps, have come across as you only wanted upvotes, which I know it is not the case, as you are always very helpful. Plus, the real point of the question was the benefit we all had from reading your answer, since I probably would have not arrived at such a sensible conclusion myself. – Lex Nov 5 '13 at 8:27
  • @Lex I think you're right. It wasn't fair of me to assume that everyone will have the same train of thought. Thank you. – Adi Nov 5 '13 at 8:35
  • And some of us will ask the question "Do I really matter?" and the answer is "Yes". You haven't lived until you've had half a dozen federal police on your front porch wanting to come in and talk. – Michael Hampton Nov 6 '13 at 2:03
  • 1
    @MichaelHampton If I had the time and the capacity I'd tell you mma couple of exciting and novel-worthy storie and I still think I'm not that imprtant. If you think you're that important, then I don't think you should be talking advice from a random person online. – Adi Nov 6 '13 at 6:30
  • To quote Cheap Trick - "Surrender / Surrender / But don't give yourself away". – Bob Jarvis May 2 '16 at 18:19

It's a call you have to make for yourself, essentially, based on a few criteria.

As developers, we often encounter situations where we could reasonably easily insert malicious code, and the reason that the majority of us don't is that we're not complete dicks. In some cases, it would even be easy to make it seem accidental, and sometimes it would be easy to deliberately code in a weakness to exploit later. Hell, it's actually one of the biggest problems we face, having devs who can't avoid it.

So, whether or not you can trust them depends on essentially how paranoid your outlook is, and that will, like Adnan said, depend on who you are and what you're doing.

A somewhat useful point is that you can almost certainly trust Google, and the other big players, not to give your info to criminals, which is the real security threat. Being blackmailed by the NSA, FBI, CIA, MI5, Police, KGB or Stan Smith from American Dad is way less of a problem than being blackmailed by criminal groups. With access to your emails or something similar, most people could find something you wouldn't want reveal, and then it's just a matter of their morals as to whether they exploit that.

But very little of it will come down to passwords really, again like Adnan mentioned, a password isn't how most big agencies would go about accessing your information, they go through proper channels, that various laws have carefully allowed for.

I realise that I've mentioned a lot of the same points, but I hope I've also added some food for thought. It's a more complex issue than it seems on the surface.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.