5 ms·
Google Stores Your Old Passwords
- denzil_correa 15y agoDoesn't quite make sense to me. Probably, they are just storing the hash. Isn't it?
- deleted 15y ago[deleted]
- xyzzyz 15y agoAll they need to do is store the last modified date to provide this behaviour. If the behaviour is "show message about password change if user tries to log in with old password", then no, it's not enough.
- dchest 15y agoNowhere in the quoted text it says that they store password. Account recovery page doesn't ask for it. I think they just store the time of last password change.
- j_s 15y agoIt may be possible to interpret the quoted text in the manner you specify, but the article's author has clarified in the comments that the notice only appears when an old password is entered. quoted: "It looks like you've attempted to sign in using an old password." (Specifically: not "an incorrect/wrong/invalid password", but "an old password".) comment on article: "Not true. The message is only displayed when you enter an old password."
- tbassetto 15y agoWhen you change your Google account password, if you enter one of your previous password you will see a warning like "You can't set a previous password". That's right, impossible to set one of the password your used in the past. And Facebook does the same. I've already seen "You tried to use an old password. It has been changed a few days ago.".
- bradleyland 15y agoThis is pretty common practice from a security standpoint. Many password security policies deny you the ability to reuse past passwords. It seems scary to the layman, but I'd imagine that Google is using secure, non-reversible encryption on passwords, so it's a non-issue.
- maytc 15y agoThe end of the article, the post confirms that Google stores a hash of the password. Very misleading from the title of the article.