By saving all the passwords for all users forever, are companies accidentally creating a less secure environment?
Related to this question: Why do some sites prevent users from reusing their old passwords?
I understand that companies feel that they need to be protected, but by everyone taking the same strategy, it creates a poor security environment. It seems less secure to me. Am I missing something?
Just to be clear, they shouldn't be storing previous passwords, but hashes, preferably salted. Storing a password in plaintext is a no-no. Storing hashes for the last few passwords may be reasonable although debatable. Storing the whole history sounds overkill. You are wasting storage in a vain attempt to protect people from themselves.
Too many password policies are outdated or downright nonsensical. Insisting on special characters or non-intuitive patterns is indeed a reason why people rotate their passwords or they change just one character. The result is that they end up using predictable patterns. Whereas a passphrase long enough would be more memorable and as secure. The longer it is, the harder it would be reverse it from a stolen hash. Ironically, many sites don't allow long passwords, like > 20 chars.
Which leads us to another question (that was not asked). Does it make sense to force people to change their passwords every 3 months or so (which is the main reason why that "password history" exists in the first place) ? If people were using unique passwords for each site, then there would be less worry about a password being compromised at one particular place. (A simple solutions exists: using a password manager).
To answer the question: that could be a possible security risk, depending on implementation. Storing plaintext passwords: red flag. Storing salted hashes: better. But what are they actually achieving in terms of security ? Very little I'm afraid.
If you store all the password history of a user, by mitigating one weakness you end up introducing another.
Weakness 1: users might reuse old passwords, possibly invalidating a security control (the security control that was meant to stop attackers from getting persistent access once they have stolen a password).
Weakness 2: all the history of passwords is stored in the database, so in case of a leak the attacker will gain a lot more information, possibly even stealing old passwords that a user might still use somewhere else. Imagine this password history: ['stackEx178', 'stackEx179', 'reedStackEx!', 'f8o17dh4m834H', 'r837cbKeTW7p9']. It looks like the user at some point started to use better passwords, maybe they even learned (or they were forced to learn) to use different passwords on different websites... but the old passwords (or similar passwords based on the old bad habits) might still be in use on some other websites.
By trying to mitigate weakness #1 (deciding to store all the passwords) you end up introducing weakness #2. However, I'm not sure which weakness would be the worst. Is it better to let users reuse the passwords? Or is it better to risk leaking the full history of passwords in case of an attack? I don't know.
All I can say is that by using very strong hash functions (with salt and pepper), you might be able to contain the damage in case of a leak. And by implementing some kind of access monitoring you might be able to mitigate the risk of stolen credentials without relying on regular password changes. I personally wouldn't like to store old passwords in the database forever, and would prefer investing more resources on some kind of access monitoring, suspicious behavior detection, and user training if possible.
