6

When I changed my Facebook password yesterday, by mistake I entered the old one and got this:

Screen capture of facebook login

Am I missing something here or this is a big potencial risk for users.

In my opinion this is a problem BECAUSE it is FaceBook and is used by, well, everyone and the latest statistics show that 76.3% of the users are idiots [source:me], that is more that 3/4!!

All kidding aside:

  • Isn't this useful information for an attacker?
  • It reveals private information about the user!
  • It could help the attacker gain access to another site in which the user used the same password
    • Granted, you should't use use the same password twice (but remember: 76.3%!!!)
  • Doesn't this simply increase the surface area for attackers?
  • It increases the chances of getting useful information at least.
  • In a site like Facebook 1st choice for hackers and (bad) people interested in valued personal information shouldn't anything increasing the chance of a vulnerability be removed?

Am I missing something? Am I being paranoid? Will 76.3% of the accounts will be hacked after this post?

Improve this question
2
  • Would this display if you hadn't logged in from the same computer? – John Straka Feb 9 '11 at 14:50
  • @John AFAIK yes, but you can try it out with the dummy account I you want! – Trufa Feb 9 '11 at 14:55
8

I think the security risk is minor.

However, I'd feel a lot better if they removed the text that tells you you have tried an old password, and just showed this message every time you entered an invalid password after changing your password recently.

I think that would give you the best of both worlds - it lets you know that your password has been changed recently, and where from, and alerts you to the fact that you MAY be trying to use an old password. It doesn't give away one of your (albeit old) passwords to potential attackers

Improve this answer
4
  • Actually, I like your solution better, yes. Just say "you entered an incorrect password, by the way your password was recently changed" but display that same message for all incorrect passwords. – Dean Harding Feb 9 '11 at 15:39
  • An old password notification definitely leads to a vulnerability. At this point an attacker would know a possible username or email associated with the account and that their password attempt is a password that the user uses...now just to find where else they have accounts and find the matches on the passwords. Most people reuse passwords... – Rig Oct 4 '13 at 14:51
  • @Rig: attackers should be your least concern because it is equivalently hard to try out the old password and the current password. The main concern should be users who accidentally typed a wrong user name and a wrong password that happened to be yours, and the user must be curious enough to decide to dig deeper about your account, now calculate the odd. – Codism Oct 4 '13 at 15:55
  • Never said it is a gross vulnerability but it is one even if it is on the slight side of things. – Rig Oct 4 '13 at 18:17
5

I'd say it could be a security risk, albeit minor.

What it tells an attacker is, YES, that password used to be a valid password for this email address.

As Trufa says, the attacker could then take this combination and try other sites. So it's not going to be a security issue on Facebook (unles... how does Facebook handled resetting your password to an old password?), but it could be on other sites.

Improve this answer
1
  • 2
    I would guesstimate it may be worse than that - that it IS a security issue on Facebook. I've seen (admittedly poor) user practices when passwords are changed - a "1" at the end is changed to a "2" and so on. So if "P4ssw0rd1" used to be valid password, Joe Hacker could be emboldened to move forward to try "P4ssw0rd2", etc. until FB lets him in. – Jesse C. Slicer Oct 4 '13 at 16:09
1

I don't see what the security risk is, it's not telling you what the old password was, just that it was changed. If the attacker can guess your old password, then it wasn't a good password to begin with.

In fact, a problem for Facebook is exactly that people have weak passwords, and it's not uncommon for a jilted lover or school bullies to "guess" your password, change it so you can no longer log on, and then post lots damaging stuff about you in your own name.

I assume they added this feature in response to that problem - so that you know if you can't log in, and it says "Your password was changed on (some other computer)" that you've probably had your account compromised.

Improve this answer
6
  • 4
    The attacker already knows what the old password is, as they entered it. The risk is to OTHER websites, and possibly even Facebook in the future. – ozz Feb 9 '11 at 15:28
  • @james: I don't think it's Facebook's fault if you choose a weak password to begin with. First of all, we don't know how long Facebook displays this "you entered an old password" message. Maybe they only do it for a week after your password changed, in which case, what difference does a week make? If the attacker had come in a week earlier, he'd have got into your account anyway. – Dean Harding Feb 9 '11 at 15:31
  • Besides, if you have a problem with your Facebook password and you feel like you need to change it, then you should also be changing it on all sites that used the same one. – Dean Harding Feb 9 '11 at 15:33
  • that is not their responsibility agreed but, that they should do everything to avoid there users getting hacked is a whole other issue. – Trufa Feb 9 '11 at 15:35
  • 1
    It's not a huge security issue but it is still giving a fact away that they do not need to. – ozz Feb 9 '11 at 15:36
1

In my humble opinion:

  • It's a very bad practice
  • It tells an attacker: "you are getting warmer"
  • No hint whatsoever about a password should be given other than "wrong password or username". Notice that the message should even leave you with the doubt of whether you enter the wrong password or the wrong username.
  • Facebook just might as well tell you:

"Sorry, the password you entered belongs to the user John Smith"

or

"Sorry, the password you entered is off by two characters"

Improve this answer
-6

Actually it's pretty standard.

If you click the request link, you get taken to a page where you can enter enough info that it can identify your account (email address or phone number is the simplest), and it will send you a new password. You don't get to set or see the new password from that page, so a hacker would also need to gain access to your email.

This is how most online authentication systems work, including the systems used by StackExchange sites as far as I know.

Improve this answer
7
  • 1
    Really? StackExchange doesn't do any authentication, it's all handled by OpenID providers. I've not met another system that told you that you had entered an old password, except when you were changing your password. – Malfist Feb 9 '11 at 15:24
  • 4
    -1 - missing the OP's point completely. He is asking about the "fact", an old password/email combo that Facebook could be telling an attacker, who could then try this on another website. – ozz Feb 9 '11 at 15:27
  • 2
    John - here's a scenario. I'm trying to hack into my mom's various online accounts. I know that she tends to use the same passwords on every site. I try several guesses, and on guess #4 I get this message. I immediately think, "Oh, neat! I wonder if she's still using this old password elsewhere?" and promptly try to log into her bank account. She's still using the old password there, so I happily write myself a check for $3,000 using her online bill pay, change her banking password, and log out. I didn't break into Facebook because of this vulnerability, just something more important. – Ethel Evans Feb 9 '11 at 20:21
  • 1
    Adding automation to detect when this message shows up after retrying the same password over and over again makes it more powerful. Tools like Watir or Selenium plus this vulnerability could be used for some level of evil. – Ethel Evans Feb 9 '11 at 20:23
  • 1
    @JohnL - I know that, and again you are STILL missing the original point. Attacker tries a combination, receives message about the password being an OLD password, now attacker has the FACT that this used to be a valid combo. They can now try and use this combo elsewhere as it is common for users to reuse passwords on other sites, the password doesn't need to be displayed, the attacker already knows it as they tried it. It's the same idea as not displaying a message like "invalid password for the account" - now you know the login name is real. Did you not read our answers/comments AT ALL? – ozz Feb 9 '11 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.