2

When you try and recover your password on Google, you will eventually stumble across this screen, and it made me wonder:

Google recovery by old password

Isn't this type of password recovery from Google essentially the same as allowing the user to log in with an old passwords? Thus making it impossible for the user to fix a compromised password.

How does Google secure this process? I assume they must have some additional check, maybe based on cookies or the client IP.

Improve this question
6
  • 2
    That's just one check of many. I've forgotten my password and have had to wait days before someone contacted me over the phone to verify my identity. The lesson I took from it, never forget your Google password.
    – RoraΖ
    Commented Nov 11, 2014 at 16:10
  • In some cases they'll let you change the password immediately after entering the old password. In other cases they'll skip to the next step as if you pressed "I don't know".
    – JohannesH
    Commented Nov 11, 2014 at 16:12
  • 1
    I would recommend enabling 2-factor authentication to avoid this type of issue in the future. 2-factor authentication requires a password and a device in order to properly authenticate. You could also look into using a FIDO key. You can read more about it here: Strengthening 2-Step Verification with Security Key
    – injector
    Commented Nov 11, 2014 at 16:44
  • 3
    2FA doesn't prevent you from forgetting your password. 2FA might be part of the recovery process, but I don't think it's an answer to the OP's question.
    – RoraΖ
    Commented Nov 11, 2014 at 18:46
  • 2
    2FA is a good recommendation, but does not at all address the question asked here.
    – Iszi
    Commented Nov 12, 2014 at 2:04

1 Answer 1

Reset to default
1

No. The correct/incorrect old password is just data used in a recovery process. Google knows how you changed the password (via forgot password, via the normal change screen) and when, and how old the password is in numbers (eg you changed password 2 times after this old password).

So this data is used in a general scoring model to determite if you are a legitimate owner of the account.

So a example:

Entering the previous password, and that password was changed for a hour ago, google might allow you access with that old password immediately.

Entering a old password changed for a month ago, might direct you to the screen that allows recovery by secret question.

Entering a very old password, might get you to "get a SMS code to recover your account" procedure.

And entering a outright incorrect password might send you to the screen that require customer service interrogation Before recovering access.

Improve this answer
2
  • Well, let's say a password is compromised right after it is changed some day. Then an attacker might still be able to access the account, even if the users changes the password again. Hopefully Google uses several other parameters in that scoring model besides password age.
    – JohannesH
    Commented Nov 17, 2014 at 21:52
  • Yes, they also use cookies and IP adress in the scoring model. Just trust that google is really thinking about security.
    – sebastian nielsen
    Commented Nov 17, 2014 at 23:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .