Skip to main content

Google stored some G Suite passwords in plaintext, free accounts not affected

Google today alerted G Suite admins about two incidents where users’ passwords were improperly stored. This security issue only impacts paid Google accounts and free consumers are not affected.

As an overview, Google’s core sign-in system is not aware of the actual characters that make up your password. Rather, it remembers and associates a hash function — 72i32hedgqw23328 versus GoTFinaleWasOnlyOk789 — with your account username.

Both are then also encrypted before being saved to disk. The next time you try to sign in, we again scramble your password the same way. If it matches the stored string then you must have typed the correct password, so your sign-in can proceed.

For G Suite enterprise accounts, Google previously offered IT administrators tools to create and recover employee passwords. The fault lies with the latter, since deprecated, utility:

We made an error when implementing this functionality back in 2005: The admin console stored a copy of the unhashed password. This practice did not live up to our standards.

For over a decade, some passwords were stored as readable plaintext. Google notes that these passwords never left its secure encrypted infrastructure, and that there’s no evidence of “improper access to or misuse of the affected passwords.”

Google today also detailed a second issue related to the G Suite customer sign-up flow. Starting in January 2019, a “subset” of unhashed passwords were stored for a maximum of 14 days.

This issue has been fixed and, again, we have seen no evidence of improper access to or misuse of the affected passwords. We will continue with our security audits to ensure this is an isolated incident.

In response, Google today emailed G Suite admins a list of impacted users that should set a new password. Next week, Google will reset accounts that have not done so themselves.

FTC: We use income earning auto affiliate links. More.

You’re reading 9to5Google — experts who break news about Google and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Google on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel

Check out 9to5Google on YouTube for more news:

Comments

Author

Avatar for Abner Li Abner Li

Editor-in-chief. Interested in the minutiae of Google and Alphabet. Tips/talk: abner@9to5g.com