3 ms·
Talking about password recovery: Google has an interesting attitude. I recently lost password to a dev account on gmail I created few weeks earlier so had to re
by jakub_g 11y ago
Talking about password recovery: Google has an interesting attitude. I recently lost password to a dev account on gmail I created few weeks earlier so had to reset password.
I went through a process in which they asked questions "when more or less was account created", "when did you last log in successfully", "what last password do you remember", "what google services did you use with this account" etc. which, mixed with some other data they possess (I believe), like IP addresses, made me successfully recover the account without any "maiden name" questions.
- cballard 11y agoAll of those seem fine, except for "what last password do you remember", which is horrifying.
- Diederich 11y agoWhy? I suspect that just means that they keep the various versions of your hashed password. Some regulatory requirements mandate that passwords not be re-used for a period of time; that would be enforced the same way.
- Nadya 11y agoYou're thinking of the wrong attack vector/issue with this. Imagine your account was compromised. You reclaim your account. The previous cracker recovers your account from you because they knew your previous password and went through the recovery process. The above happens more often than you might think.