Hundreds of Thousands of People Are Using Passwords That Have Already Been Hacked, Google Says (vice.com) 58
A new Google study this week confirmed the obvious: internet users need to stop using the same password for multiple websites unless they're keen on having their data hijacked, their identity stolen, or worse. From a report: It seems like not a day goes by without a major company being hacked or leaving user email addresses and passwords exposed to the public internet. These login credentials are then routinely used by hackers to hijack your accounts, a threat that's largely mitigated by using a password manager and unique password for each site you visit. Sites like "have I been pwned?" can help users track if their data has been exposed, and whether they need to worry about their credentials bouncing around the dark web. But it's still a confusing process for many users unsure of which passwords need updating.
To that end, last February Google unveiled a new experimental Password Checkup extension for Chrome. The extension warns you any time you log into a website using one of over 4 billion publicly-accessible usernames and passwords that have been previously exposed by a major hack or breach, and prompts you to change your password when necessary. The extension was built in concert with cryptography experts at Stanford University to ensure that Google never learns your usernames or passwords, the company says in an explainer. Anonymous telemetry data culled from the extension has provided Google with some interesting information on how widespread the practice of account hijacking and non-unique passwords really is.
To that end, last February Google unveiled a new experimental Password Checkup extension for Chrome. The extension warns you any time you log into a website using one of over 4 billion publicly-accessible usernames and passwords that have been previously exposed by a major hack or breach, and prompts you to change your password when necessary. The extension was built in concert with cryptography experts at Stanford University to ensure that Google never learns your usernames or passwords, the company says in an explainer. Anonymous telemetry data culled from the extension has provided Google with some interesting information on how widespread the practice of account hijacking and non-unique passwords really is.
At least with AC posting... (Score:2)
I never had to expose my password
Re: (Score:2)
It's ${current_year} and you are still not logging in as CowboyNeal?
Whats the point (Score:2)
How we just stop and then laugh at them when their shit gets hacked. That prolly (will not) get them to properly manage their passwords.
No, it's your fault. The users are innocent here (Score:3)
Re: (Score:2)
No, it's your guys' fault for not salting and hashing passwords properly
I always used "SaltedHash1" as my password, I still got hacked! In fact, this isn't me writing this, it's someone who hacked my Slashdot account.
Re: (Score:3)
Re: No, it's your fault. The users are innocent he (Score:2)
Re: (Score:3)
Or they course use a password manager - that not be able to get in to the websites if there's a problem. Or if someone hacks the password manager. Or... Or...
There's no easy way to fix this - but blaming it on the end user is the height of arrogance.
Re: Whats the point (Score:2)
Re: (Score:2)
Hundreds of Thousands? Not even close... (Score:4, Informative)
How about Millions or Billions?
Face it, you are massively underestimating the number of stupid people out there.
Re: (Score:2)
Since estimating password strength requires some advanced Mathematics, I mostly fault the incompetence of the CS community in coming up with sane guidelines for creating this mess.
Re:Hundreds of Thousands? Not even close... (Score:4, Interesting)
Complex password requirements usually result in people writing them down and sticking them to their monitor or keyboard
Also, most cracking software does not rely on simple dictionary attacks, so complex passwords really are not the panacea they seem to be
The primary problem is that businesses that develop apps do not put security first and even if they did, proper security standards for software development do not exist
If companies and developers cannot produce secure software, then forcing people to follow password guidelines is just kabuki
Re: (Score:2)
Indeed. And if there were not so many businesses that do not even understand the basics of secure password storage and then got hacked, the attackers would never have gotten this much data bout what passwords users chose.
I think we will eventually need what all other engineering disciplines have: Strong requirements as to qualification. That will make coders much more expensive, but it will be well worth the price.
Re: (Score:2)
Indeed. While a complex password does increase the keyspace, once you introduce the human element, the increase in keyspace goes form exponential to linear.
Enough that password crackers will try common substitutions as part of a dictionary attack.
Say for "password", a cracker will also try "passw0rd", "pa55word", "pa55w0rd", "p4ssword", "p455word" .... "Password", "Passw0rd
Re: (Score:2)
My wife has a little black book in her top drawer with all her passwords in it (not her important ones).
Her argument is that someone has to physically break into the house, force open the drawer and take the book.
Unless someone...
a) knew the book was even there
b) actually cared enough to circumvent the home security alarm, armed response, guard dogs etc. to get to the book
They would p
Re: (Score:2)
The trick is to write the passwords down incorrectly, but just wrong enough that you know how to fix it easily... Like adding one to all the digits, or using "$" instead of "#". That way you only have to remember a little fix, but whoever has the book will spend a long time trying to correct it, and because they've taken the time to get the book there is a much higher chance that they'll lock themselves out. A good chunk of online risk is offline attacks against a hash, where the three strikes doesn't ap
Re: (Score:2)
Other folks have to first see it, I have sticky notes all over the place, and then know what it means. And they have to realize the 6 is that much bigger than the 7 and 8.
Re: (Score:2)
complex passwords really are not the panacea they seem to be
This statement is similar to the panic after Edward Snowden went public when people were claiming encryption doesn't protect communications. A properly constructed random password of sufficient length would take weeks or months to crack if possible at all.
There will always be insecure websites/servers/databases, just like there will always be pirated music/movies/ebooks. Deplorable but a reality. This is why for authentication/authorisation, we need to create good passwords (for the sites that aren't hacked
Re: (Score:2)
Another problem is that the more complex the password the easier it is to spot in the key log. Which is why passphrases like "copy readme.txt C:\Temp\" or "=SUM(A1:B6)*C2+if(D1=0,A1,B1)" are good... Those are also good for saving on disk in sneaky files like "copyfiles.bat" and "Book6.xlsx", rather than "mysecretpasswords.txt".
Re: (Score:3)
And you're also massively underestimating the number of smart people out there.
I've got multiple tiers of passwords. Some sites have information that I just don't care to protect because it is of little value. For example, you make me create an account to print a recipe? Ok, I'm gonna use a really lame-but-easy username/password combination that I've used all over the place and have been involved in hacks. Because it just doesn't matter if someone knows I printed a recipe for a cake.
My bank? That's got
Re: (Score:2)
Too hard? (Score:1)
Re: (Score:2)
What does educating users about security accomplish, when they are using insecure systems?
Re: (Score:2)
That just feels like blame-shifting AC
If I go to a Fortune 500 company website, that has implemented an Oracle EBS system and NOT changed the default admin password, there is no way for me to judge that the system is insecure and avoid it.
It will always be the responsibility of the own of the site to ensure that it is being maintained in a way that does not cause harm to their customers, and that responsibility extends to the employees and contractors to that company.
Re: (Score:2)
Re: Too hard? (Score:2)
The same thing that happens when the AWS control plane gets hacked: the shit hits the fan for a LOT of people. All sorts of havoc breaks loose for a while. Then we mop up the mess and carry on.
Neither of these things have happened yet, to the best of my knowledge. But eventually they WILL happen.
Security is illusive. There is no "secure" system, only "more secure". Or "less insecure" if you're feeling pessimistic.
The problem is... (Score:2)
... companies have thrown many things online that don't need to be in order to maximize profits. Let's not mince words here, when you make every app or game online and force login registration in order to access said game or app, what exactly do you think the masses are going to do?
Let's not try to simply blame the public here, companies are obsessed with undermining peoples basic rights to privacy and software ownership. It would really help if companies limited the # of login attempts from an IP block t
Re: (Score:2)
The problem is also using setting up a system where every site/service has its own password, writing its own authentication. Not only does it mean that people have hundreds of passwords to manage, but some of them are going to do a bad job securing them.
We should really come up with a better system for authentication. There should probably be some mix of PKI and SSO for individual use instead of requiring Enterprise-grade setups to avoid needing a password manager.
Re: (Score:3)
Yep. I most likely am using compromised password/email combinations. But only on sites I don't give a shit about. Sites, like you note, that make me make a login even though there's no reason to need to do so.
Given that I have zero faith in their ability to do security, I'm definitely not going to worry about using a strong password on a site where I don't see a reason to have a login in the first place.
Re: (Score:2)
My company requires I remember 14 independent passwords/PINs for work alone. I have multiple computer logins, voicemail, building security code, proxy, reimbursement, HR portal, VPN, spec database, etc. Many have to be changed quarterly, others have not changed in 5 years. Many are used only annually (performance review system) such that it is easier to just reset it annually than try to deal with it. I then have probably another 30+ passwords for personal purposes, again many that are used quite infreq
Millions of people driving cars everyday (Score:2)
Stepping into bathtubs, leaving their homes, accepting many kinds of risks in exchange for better living. Most are rational and will prioritize their security matters pragmatically.
So this Google thing (Score:1)
So this Google tool scrutinizes my password to determine if they already have it. That's interesting. They do now...
Re: (Score:2)
If you enter a password in Chrome, they could have it already. The extensioin oesn't really change anything. It's not as if it sends the password to Google anyways.
Make that hundreds of millions (Score:4, Insightful)
The issue here is that for a long, long time most advice on passwords, and especially requiring it to be changed regularly, was bad. For example, there was this utterly stupid advice that you should not write down passwords, when in fact that is entirely fine as long as you do not make it obvious what they are for. Basically no hacker will steal your wallet as that requires physical access. And your wallet being stolen is not only a rare event, it is pretty noticeable.
Hence most people are completely clueless how to handle passwords. They are also clueless about how to chose them (and the usual guidelines about lower/uppercase , numbers and special symbols are just stupid and harm much more than they help) and they are clueless about how strong they are (even CS students often struggle with that). Hence this mess. It is a mess created IMO in equal parts by missing user education (this topic should be taught in schools) and far too much false and sometimes outright harmful "information" floating around. The latter is the fault of the CS community, and most decidedly not of the users.
tl;dr: The idea of passwords is fine, but all the myths and wrong advice given has to stop.
Re: (Score:2)
Don't forget the websites that limit password length, so the "use a passphrase not a password" doesn't work.
Re: (Score:2)
Indeed. And quite a few more stupid things.
Re: (Score:2)
Like limiting special characters to a subset, because we're too dumb to figure out how to hash and store them and are worried about our script breaking when it sucks them in. I've seen more than a couple websites do this, run by some shockingly large companies.
Re:Make that hundreds of millions (Score:4, Insightful)
I think we should also teach people that not all passwords are equally as valuable.
I use the same password for a bunch of forum sites and low-value logins. If the password is hacked and the information stolen, whatever. None of it is particularly valuable to me, so it gets a pretty weak password.
My bank password is randomly generated, stored in a vault, and will change immediately if the bank ever hints at having been compromised. In truth, I don't even know what it is, and I have to have my phone with me if I want to log into my bank's website. I only memorize one extremely strong password, and that's to my vault, and it's not used anywhere else.
Stop making people come up with complicated unique passwords for BS forums that they're only on for one question before they leave forever. Reduce the password fatigue.
Do they mean the same password (Score:3)
for multiple sites like gmail, youtube, play store, google drive... ?
"ensure that Google never learns your ..." (Score:1)
Kerberos (Score:1)
No single solution in sight (Score:3)
There are multiple reasons why so many users continue to reuse passwords and to choose hacked passwords. None of them involve the user being "stupid".
1) Bizarre and often undocumented site policies on which characters a password may contain, leading to choosing simple ones
2) Sites that limit password length or insist on a 4-digit PIN as the password.
3) Sites that require frequent password changes in the name of "security" but instead encourage simplistic derivations (add current month number to prefix, etc.)
4) Sites that interfere with password managers, such as blocking auto-fill or making the manager think the username has changed to asterisks
5) Password managers that are difficult for non-experts to use reliably, and that's pretty much all of them. I use LastPass and, while it mostly works ok for me, it still sometimes does bizarre things.
6) Users who think that they are unimportant to hackers or that their accounts have no value, thus they can't be bothered with a strong and unique password for each site.
Several password managers do automate password changes with hundreds of popular sites, and this mostly works, but first you have to convince the user that it's a good thing to do so. I have relatives who insist on reusing simple passwords, even using a password manager to store them, because they don't trust the password manager.
None of the browsers I have seen include what I would call good password managers. They can remember and fill in ok, but don't help users pick good passwords and generally don't store the passwords securely as external managers typically do. If the major browsers could up their game here, it would help. Chrome's extension is a good first step, but people have to ask for it first.
Re: (Score:1)
Thank you stevel. #4 is maddening to me. I've been using Roboform for years now and generate passwords, even for crap websites. Sites that prevent autofill are maddening and require me to copy paste my password from the vault.
Designers, use throttles to prevent password stuffing on your web forms, not limitations to legitimate uses.
Re: (Score:1)
Re: (Score:1)
Re: (Score:3)
The password managers I have used all allow for a local, encrypted copy to be saved and provide a way to decrypt the collections without relying on an external service (with the master password, of course). Even if the password manager goes belly-up and/or the cloud server becomes inaccessible, I still have complete access locally to my saved data.(LastPass, for example, by default stores a local encrypted vault copy that is used if the server can't be reached.)
There's a lot of FUD about risks of password m
Yes (Score:3)
Hundreds of thousands of websites require worthless and meaningless user registration which makes people use the simplest passwords possible 'cause they couldn't care less.
FTFY
Maybe they need to upgrade people's minds (Score:1)
Re: (Score:1)
This is reasonable, we've discussed this before (Score:2)
You know that key to your filing cabinet? It's the same as that other key to that secret lockable drawer in your bedroom closet. In fact, most shitty keys are one of a dozen popular ones, or one of a few dozen less popular ones. Identical keys, except that one has a picture of mickey mouse on it.
Your air conditioner sits outside of your house. Accessible by anyone. It doesn't even have a key. It has a screw, and not a security screw either. In fact, the safety shut-off doesn't even have a screw. It
Re: (Score:1)
You can't stop me from breaking into my friend's e-mail. But it's very easy to make me not want to do it. That's called jail time.
Your idea doesn't work. Chinese or Bulgarian hackers have no reason to fear jail time for using re-used passwords to get into Americans' online accounts. And they never will.
Re: (Score:2)
Like I said, law enforcement. No one ever said that it had to be within a single legal jurisdiction. We have plenty of laws that cross borders. We need the same ones for digital access.
Yes, just hand over ALL your passwords to Google! (Score:2)
How to make passwords unique (Score:2)
Here's how to make your passwords unique: Have a phrase that's the same for all passwords. Then append "bank" or "creditcard" or "safeway" etc. to the phrase, for your passwords for your bank, credit card, and Safeway accounts. For example:
123-iLikepeanutbuttersandwichesbank
123-iLikepeanutbuttersandwichescreditcard
123-iLikepeanutbuttersandwichessafeway
Re: How to make passwords unique (Score:2)