Google has stored some G Suite passwords in plain text since 2005

Google recently announced big news, G Suite corporate customers’ login passwords have been stored in plain text for more than a decade. According to Google’s privacy and security policies, all users’ login credentials must be stored in an encrypted format, and the encrypted format passwords are stored on an encrypted disk to ensure maximum security. The encrypted format uses a cryptographic hash to store the password, which is a one-way process that is irreversible. Every time a user logs into the app, Google uses the stored password hash for authentication.

Google provides a domain administrator for G Suite customers with a tool to set and recover passwords to help administrators upload or manually set passwords for corporate users. However, an error occurred during the development phase of this feature, causing the management console to store an unencrypted copy of the password. This error eventually led to the user password being stored unhealed but encrypted during the period from 2005 to 2019.

“In addition, as we were troubleshooting new G Suite customer sign-up flows, we discovered that starting in January 2019 we had inadvertently stored a subset of unhashed passwords in our secure encrypted infrastructure. These passwords were stored for a maximum of 14 days. This issue has been fixed and, again, we have seen no evidence of improper access to or misuse of the affected passwords.”

Google said that there have been no incidents of improper access or abuse of the affected password.