Evan Schuman's StorefrontBacktalk

Why couldn’t Amazon just automatically convert a customer to the new password system by, say, capturing the complete password that a customer typed in, authenticating it using the old system, and then storing that full password in the new system? Because the customer might easily have typed the password wrong just that once. Then any automated password-entry systems, such as Web browsers set to remember passwords, would no longer work.

And, understandably, Amazon didn’t want to simply force customers to change their passwords. That’s a standard tactic IT departments use with employees, but it doesn’t exactly make customers feel warm and friendly toward an E-tailer.

Ironically, a customer who did a password “change” to exactly the same password would end up in the new system but with his old password—this time in a more secure form.

There’s another bit of irony, too: Customers who asked Amazon’s customer support desk about the glitch were reportedly told that they should try changing their passwords. The support people didn’t know why that should work. But, naturally, when the password was changed, it would be moved into the newer, no-shortening-or-case-conversion password-security system.

Amazon won’t say what, if anything, it plans to change in the wake of all the publicity about its password security. But the publicity alone will likely prompt many customers to change their passwords, just to be safe.

All the publicity could also mean that old-fashioned password-cracking attempts could see a revival at other E-tail sites in the next few weeks. Think about it from the thief’s point of view: If Amazon had an outdated password system that it didn’t fix until a few years ago, how many other E-tailers—especially older sites—are still using the same type of easier-to-guess approach?

And even if those older E-tailers have converted to a stronger system, how many of them—like Amazon—concluded there was no good way to move customers over to the more secure approach and decided just to let customers become more secure when they changed passwords—if they ever got around to doing that?

For a thief, that’s probably worth a look. And that could mean more E-tailers soon scrambling to explain why their passwords are so flexible.