Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

When I changed my Facebook password yesterday, by mistake I entered the old one and got this:

Screen capture of facebook login

Am I missing something here or this is a big potencial risk for users.

In my opinion this is a problem BECAUSE it is FaceBook and is used by, well, everyone and the latest statistics show that 76.3% of the users are idiots [source:me], that is more that 3/4!!

All kidding aside:

  • Isn't this useful information for an attacker?
  • It reveals private information about the user!
  • It could help the attacker gain access to another site in which the user used the same password
    • Granted, you should't use use the same password twice (but remember: 76.3%!!!)
  • Doesn't this simply increase the surface area for attackers?
  • It increases the chances of getting useful information at least.
  • In a site like Facebook 1st choice for hackers and (bad) people interested in valued personal information shouldn't anything increasing the chance of a vulnerability be removed?

Am I missing something? Am I being paranoid? Will 76.3% of the accounts will be hacked after this post?

share|improve this question
    
Would this display if you hadn't logged in from the same computer? –  John Straka Feb 9 '11 at 14:50
    
@John AFAIK yes, but you can try it out with the dummy account I you want! –  Trufa Feb 9 '11 at 14:55

5 Answers 5

I think the security risk is minor.

However, I'd feel a lot better if they removed the text that tells you you have tried an old password, and just showed this message every time you entered an invalid password after changing your password recently.

I think that would give you the best of both worlds - it lets you know that your password has been changed recently, and where from, and alerts you to the fact that you MAY be trying to use an old password. It doesn't give away one of your (albeit old) passwords to potential attackers

share|improve this answer
    
Actually, I like your solution better, yes. Just say "you entered an incorrect password, by the way your password was recently changed" but display that same message for all incorrect passwords. –  Dean Harding Feb 9 '11 at 15:39
    
An old password notification definitely leads to a vulnerability. At this point an attacker would know a possible username or email associated with the account and that their password attempt is a password that the user uses...now just to find where else they have accounts and find the matches on the passwords. Most people reuse passwords... –  Rig Oct 4 '13 at 14:51
    
@Rig: attackers should be your least concern because it is equivalently hard to try out the old password and the current password. The main concern should be users who accidentally typed a wrong user name and a wrong password that happened to be yours, and the user must be curious enough to decide to dig deeper about your account, now calculate the odd. –  Codism Oct 4 '13 at 15:55
    
Never said it is a gross vulnerability but it is one even if it is on the slight side of things. –  Rig Oct 4 '13 at 18:17

I'd say it could be a security risk, albeit minor.

What it tells an attacker is, YES, that password used to be a valid password for this email address.

As Trufa says, the attacker could then take this combination and try other sites. So it's not going to be a security issue on Facebook (unles... how does Facebook handled resetting your password to an old password?), but it could be on other sites.

share|improve this answer
2  
I would guesstimate it may be worse than that - that it IS a security issue on Facebook. I've seen (admittedly poor) user practices when passwords are changed - a "1" at the end is changed to a "2" and so on. So if "P4ssw0rd1" used to be valid password, Joe Hacker could be emboldened to move forward to try "P4ssw0rd2", etc. until FB lets him in. –  Jesse C. Slicer Oct 4 '13 at 16:09

I don't see what the security risk is, it's not telling you what the old password was, just that it was changed. If the attacker can guess your old password, then it wasn't a good password to begin with.

In fact, a problem for Facebook is exactly that people have weak passwords, and it's not uncommon for a jilted lover or school bullies to "guess" your password, change it so you can no longer log on, and then post lots damaging stuff about you in your own name.

I assume they added this feature in response to that problem - so that you know if you can't log in, and it says "Your password was changed on (some other computer)" that you've probably had your account compromised.

share|improve this answer
4  
The attacker already knows what the old password is, as they entered it. The risk is to OTHER websites, and possibly even Facebook in the future. –  jmo21 Feb 9 '11 at 15:28
    
@james: I don't think it's Facebook's fault if you choose a weak password to begin with. First of all, we don't know how long Facebook displays this "you entered an old password" message. Maybe they only do it for a week after your password changed, in which case, what difference does a week make? If the attacker had come in a week earlier, he'd have got into your account anyway. –  Dean Harding Feb 9 '11 at 15:31
    
Besides, if you have a problem with your Facebook password and you feel like you need to change it, then you should also be changing it on all sites that used the same one. –  Dean Harding Feb 9 '11 at 15:33
    
that is not their responsibility agreed but, that they should do everything to avoid there users getting hacked is a whole other issue. –  Trufa Feb 9 '11 at 15:35
1  
It's not a huge security issue but it is still giving a fact away that they do not need to. –  jmo21 Feb 9 '11 at 15:36

In my humble opinion:

  • It's a very bad practice
  • It tells an attacker: "you are getting warmer"
  • No hint whatsoever about a password should be given other than "wrong password or username". Notice that the message should even leave you with the doubt of whether you enter the wrong password or the wrong username.
  • Facebook just might as well tell you:

"Sorry, the password you entered belongs to the user John Smith"

or

"Sorry, the password you entered is off by two characters"

share|improve this answer

Actually it's pretty standard.

If you click the request link, you get taken to a page where you can enter enough info that it can identify your account (email address or phone number is the simplest), and it will send you a new password. You don't get to set or see the new password from that page, so a hacker would also need to gain access to your email.

This is how most online authentication systems work, including the systems used by StackExchange sites as far as I know.

share|improve this answer
1  
Really? StackExchange doesn't do any authentication, it's all handled by OpenID providers. I've not met another system that told you that you had entered an old password, except when you were changing your password. –  Malfist Feb 9 '11 at 15:24
3  
-1 - missing the OP's point completely. He is asking about the "fact", an old password/email combo that Facebook could be telling an attacker, who could then try this on another website. –  jmo21 Feb 9 '11 at 15:27
    
@Malfist: Which would mean OpenID is a system used by StackExchange. Ok, some OpenID providers may do things differently and not send you an email with the new password, but the ones I've used so far do some variation on that - Google IIRC sends a re-activation link which you click on and then you can enter a password. –  JohnL Feb 9 '11 at 17:40
2  
John - here's a scenario. I'm trying to hack into my mom's various online accounts. I know that she tends to use the same passwords on every site. I try several guesses, and on guess #4 I get this message. I immediately think, "Oh, neat! I wonder if she's still using this old password elsewhere?" and promptly try to log into her bank account. She's still using the old password there, so I happily write myself a check for $3,000 using her online bill pay, change her banking password, and log out. I didn't break into Facebook because of this vulnerability, just something more important. –  Ethel Evans Feb 9 '11 at 20:21
1  
Adding automation to detect when this message shows up after retrying the same password over and over again makes it more powerful. Tools like Watir or Selenium plus this vulnerability could be used for some level of evil. –  Ethel Evans Feb 9 '11 at 20:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.