Does a successful login prove the password was known?¶

A successful login does not always prove that the person or system making the request knew the account password.

Avoid the dangerous assumption¶

The dangerous assumption is that authentication success means a password was entered correctly by the offender.

Access may instead have used:

• a remembered browser session
• a session cookie
• an access or refresh token
• single sign-on
• a trusted device
• an application credential
• a recovery link
• passwordless authentication
• a remote session already logged in.

Even where the log describes “password authentication”, it may not show who entered the password or how they obtained it.

Ask what authentication method the provider recorded.

Was a password used?

Was multi-factor authentication required?

Was an existing session refreshed?

Did an application act through an API?

Was the device already trusted?

Did the provider reauthenticate the user or simply accept a valid token?

Provider terminology varies, so product-specific interpretation may require current documentation or specialist support.

A successful login can prove that the service accepted the presented authentication material. It may also link the event to an account, device, session, source address or application.

It does not automatically prove that the account holder initiated the login or that the password was compromised.

The device may have been remotely controlled. The account may have been shared. A session may have been stolen. An automated service may have authenticated.

Preserve the full sign-in record, authentication method, session information, device details, account changes and surrounding events.

Operational takeaway¶

Treat successful authentication as proof that the service accepted the presented method, not automatic proof that the offender knew or entered the password.