<img src="http://lh3.ggpht.com/_0Hj1X7xRrnE/SeV4qb3wghI/AAAAAAAAAhI/onDS4dexS0k/Picture%201.png" />
Disclosure: I <3 Google. But I'm disappointed with their new heavy-handed password regimen. Trying to check my Gmail account this afternoon (but not this morning... odd), I was greeted with a warning page after I had logged in: my password was "weak" and needed changing.
This may be true, however I was alarmed that Gmail
knew my password. Call me old-fashioned, but I was under the impression that it was fairly standard procedure to store user passwords after performing a
one-way hash like MD5 (now
insecure) or SHA1.
(For the non-geek:
a one-way hash is a mathematical operation that scrambles data in a way that it cannot be unscrambled: your password would always be hashed to the same scrambled text, but no one could unscramble that text to get your password. This means that your password is stored in a web site's database in such a way that the web site does not know-- and no rogue database administrator can ever determine-- what your
actual password is. When you login, they scramble the data you send using the one-way hash, and compare it to the scrambled value in their database, and if it matches, they know you typed it in correctly. The reason hashed passwords are so important is that most people use the same password on multiple
sites, so any web site that knows your actual password could use it to
impersonate you on other web sites. As an aside, one of the reason I love Computer Science is it's the only field where phrases like "
salted hash" can have only mathematcial connotations.)
I appreciate that Google is trying to look out for my safety, but I
couldn't even login without changing changing my password. They weren't warning me so much as
commanding me. As a geek I understand that tough love is sometimes necessary; password security works like vaccination: if we're not all safe, we're all vulnerable, or something like that. However, I would have appreciated a window of a couple of days so that I didn't have to go and change the passwords on all my Gmail-linked services to keep them working just to check my email.
(Reality check: OK, so it was only 2 services, but still, it's the principle.)
The most insulting thing is that when I added a "1" to the end of my password, it instantly changed from "weak" to "strong."
Great work on that password strength-checking algorithm, Google. No brute force hackers will figure that "1" out.