Is Google exposing our old passwords?

Have you ever noticed Google telling you “your password was changed X days ago” when you type your old password?

And how about when you type several old passwords and Google keeps telling you the same message?

That’s the security feature to tell the users on Google Accounts interface they changed their password sometimes ago, when they type an old password. Google keeps telling you this even if you:

1)      changed your password 3 months ago

2)      type all your old passwords (at least mine)

3)      access your account everyday several times a day

The problem here is a brute force attack could expose passwords used by users before. If we consider there is a practice in which users have the same password for different services on the internet (and most of the time they have a pattern to create passwords, changing only one letter or number), the fact that an attacker can guess an password used by somebody by brute forcing the Google Accounts  service could help him to deliver a more targeted attack.

Consider this type of attack on a high profile account.  Password is very personal and sensitive information.

I wrote to Google to talk about this and Google Security Team answered me right away on the next day.

Some snippet from the email:

“we do have to balance security with usability and the safety of
our users. If we were to just give a generic error message a user may not
realize that their password was changed by an attacker, this could prolong
the period that an attacker has access to their account. Our hope is that
if a user sees the current error message they will have a better chance of
understanding why their password doesn't work (it was recently changed and
not by them).”

Services like Yahoo and Hotmail give a generic error message if you type some of your previous password used. Google also says they have additional security controls against brute force that would mitigate the risk. 

I think it’s a really valid approach to tell users they changed their passwords but it’s possible to do it sending a SMS (yes, not so cheap!) or an email to your alternative email informed on your Google’s account.

And you, what do you think about this? Leave your comments.