After updating my password, the old password is still stored in the database

[seifferth]

I have recently changed my password in the Delta Chat settings. However, now both the old and the new password are stored in the database:

sqlite> select keyname, value from config where keyname like '%_pw' order by keyname;
configured_mail_pw     [[ old password ]]
configured_send_pw     [[ old password ]]
mail_pw                [[ new password ]]
notify_about_wrong_pw  1

Since both passwords remain valid, I do not even know which password is used for retrieving and sending emails. Anyhow, I would have expected that replacing the only occurrence of the password in the settings would also replace any occurrence of the password in the database; and I am a little surprised to find that the old password is still stored in the database. I suspect that other people might also be surprised by such behaviour.

Note: I had previously opened this issue as deltachat/deltachat-android#3906, where I was redirected here. I currently use Delta Chat for Android version 2.11.0.

Regarding "working configuration" (mentioned in deltachat/deltachat-android#3906 (comment)): I would understand if the old password was stored in the database while I am editing the configuration so that the configuration can be rolled back if the new configuration does not work. However, there is no indication in the UI that the configuration I see below "Settings – Advanced – Password and Account" does not work; and if I store the new configuration again, the UI seems to indicate that that operation was successful. The result of the SQL query specified above (run against the new database after updating the settings yet again) is still the same.

It is possible that I had at some point explicitly specified the old password in the fields for specifying IMAP and SMTP credentials (I do not remember doing this, but I could easily have forgotten something like this). However, currently the UI shows these fields to be empty, which I find somewhat misleading given what is stored in the database.

[iequidoo]

In fact all these configured_*_pw config keys are deprecated by the new transports table, and mail_pw is to be deprecated too when we finally implement multi-transport. The bug here is that these configured_*_pw aren't cleared and remain in the db forever. May be even considered as a security issue.