Password reuse is rampant: nearly half of observed user logins are compromised

https://blog.cloudflare.com/password-reuse-rampant-half-user-logins-compromised/

by cassianoleal • 1 year ago

32 43 1 year ago

blog.cloudflare.com

Rucadi• 1 year ago

Passwords are a pain in the ass, I just wished that having a cryptographic key installed in your device (and linked to it) to login to stuff or having an external crypto-device to login was easier and more common.

For local access, biometrical is fine, and a "super-secure" password for if something happens that can only be used once would be the way.

dsego2• 1 year ago

I want to be able to tie digital credentials to my identity so if they are compromised or I loose access I can recover them by providing my national ID documents. Similar how I do with my bank app, I go to the bank, show my ID, sign some forms and reset all the creds. I don't have to fear loosing access. On the other hand if I loose my google account I'm screwed, all my other services depend on either my email address or google 2fa keys to prove my identity.

spacebanana7• 1 year ago

I fear that mixing government IDs to commonly used digital credentials could invite lots of privacy violations from businesses and governments.

It'd be much easier for porn & social media ID laws to be enforced. Which could be abused by adtech and law enforcement.

05• 1 year ago

a "super-secure" password for if something happens that can only be used once

With 99.99% chance you forget it before you ever get to enter it because humans forget things they never use :)

Lanolderen• 1 year ago

You can store it in paper with your other important documents. It's not unstealable but if someone nicks your document folders you're spending two weeks redoing/reissuing everything anyway.

IlikeKitties• 1 year ago

Just use a KeepassXC and you are 99% there. Add some Browser extension that synchs with it and only use randomly generated passwords.

techjamie• 1 year ago

I've taken a liking to using a self-hosted Bitwarden instance via vaultwarden, and it's been a pretty good experience. The vaultwarden server is only accessible through my Tailscale network for extra security.

https://github.com/dani-garcia/vaultwarden

PaulKeeble2• 1 year ago

I use KeepassXC as well and it works well enough. Its still not as clean as just an SSH key login which we could have done on the web years ago and would make everyone’s life easier.

shakna3• 1 year ago

Biometrics are really not fine. They're somehow supposed to be some permanent marker of who you are, but that's really not how it works in the real world. You physically change.

I've broken any biometrics recognising me in a dozen different ways, this year alone. Cut open my finger, changing my fingerprint. Head surgery for melanoma gave me a scar so facial recognition doesn't work anymore, blood vessel burst in my eye, so iris scan changed. And so on.

They're fine for a convenience, but that's it. They're nothing more than a pin, and you will have to fall back to password or authenticator or something else, sooner or later.

nbadg• 1 year ago

Also, even if they work as desired, if they're ever compromised [1], you're permanently unable to use that form of authentication, or permanently vulnerable to services that use and/or require it.

[1] https://en.wikipedia.org/wiki/Biometrics#Data_security

Ajedi32• 1 year ago

Again, biometrics are fine for local access. If you cut your finger or scar your face just use your backup method (maybe a pin, maybe a different finger) to get in and update the scan. And if someone steals your fingerprint they can't use it without having physical access to your device, because again, this is for local access.

For remote authentication you use a private key accessed via the local system (which you are already authenticated to using biometrics).

vikingerik• 1 year ago

There's also this failure case: I know a pair of sisters who look and sound identical enough that they can unlock each other's phones with face and voiceprint recognition.

vel0city• 1 year ago

I use these a lot when available, often called "passkeys".

PaulKeeble2• 1 year ago

We could have been using SSH key logins for decades at this point but no we had to go and use usernames and passwords everywhere.

I don't want a key limited to a single device I just want a strong key that can automatically login to a website. The technology has existed for longer than the internet it just needs to become the norm.

otabdeveloper4• 1 year ago

Frankly, I'd rather deal with the consequences of being compromised than with the problems of memorizing and recovering passwords.

loxs• 1 year ago

Did we need a study to know this? It is obvious to anyone who has ever seen a non-techie use an online service.

anacrolix3• 1 year ago

Maybe if we weren't letting a third party sign arbitrary certificates for arbitrary domains they wouldn't be reading our passwords.

People don't realise CloudFlare is a MitM-as-a-Service.

dizhn• 1 year ago

What do you mean? Is cloudflare causing 3rd parties to read our passwords?

doublerabbit2• 1 year ago

Could.

A HTTP post request along the wire is unencrypted.

I'm talking about a submit button not HTTPS as that just encrypts the connection session and not the data sent from say a form.

If you're using or utilising CF for something where the data is being posted to an API unless you have client side encryption anything receiving that data will be received in plain text.

Someone only needs to compromise the service worker and syphon the data.

tomesch1982• 1 year ago

What's more problematic is that Cloudflare is obviously reading and storing and analyzing passwords. So every service that uses Cloudflare on a login page is compromised. I bet that there are several Excel files with all scraped passwords circulating within Cloudflare.

anacrolix3• 1 year ago

CloudFlare is the 3rd party.

Try implementing what CloudFlare does yourself. You will very quickly realise how it works. It's actually pretty crazy.

jgalt212• 1 year ago

This is why using email addresses as usernames is a bad idea. Credential stuffing is trivial under this scenario.

bananapub• 1 year ago

which is especially problematic I guess when random American companies are MITM the traffic and examining the unencrypted passwords?

ldng• 1 year ago

Yes. Especially with that government...

illiac786• 1 year ago

I didn’t know about this, which companies are doing this?

moktonar2• 1 year ago

Cloud flare is an ooc spof, this will need addressing sooner or later

fooofw• 1 year ago

Out-of-control single point of failure?

moktonar2• 1 year ago

Exactly

stormfather• 1 year ago

I have a rule that modifies a base password depending on the name of the site the password is for. That way I only have to remember the base password and the rule.

chatmasta• 1 year ago

I have three of your passwords and the domain each is associated with. The pattern is obvious, so now I have all your other passwords too.

Also, you don’t need to remember only the base password and the rule. You also need to have an exceptions process for when your “generated” password is incompatible with the esoteric requirements of a new site (length, character restrictions, etc.). And you need to remember this at login time, when you aren’t presented with the same information about those requirements as you were when you registered.

wan23• 1 year ago

When I used to do this (and I feel safe talking about it because I haven't done this in many years), I also kept a document that listed any such exceptions. Generally the document would just say something like "mixed case, number, symbol" which was enough to remind me what I did.

blakeburch• 1 year ago

I used to do this (10+ years ago), but once a few get leaked, everything else would get exposed if someone wanted to target you.

Much easier to just manage randomized passwords through 1Password.

jgrahamc2• 1 year ago

I used to do this but stopped a very long time ago. I use KeePassXC instead. It’s much more secure and much better at handling websites with special password requirements.

dsego2• 1 year ago

There is an improved version of this, basically a password generator based on a phrase + service name - https://getvau.lt The issue is that once a password is compromised you need to change how you generate it and remember this exception in the future.

mcv• 1 year ago

I have a standard password that I know has been leaked, and I don't care. I use it only for accounts with no value. Accounts that don't hurt me if they get hacked. Obviously my email, bank and primary social media use strong passwords.

Maybe someone should investigate how many sites require a password but really shouldn't.

lousken• 1 year ago

But why? I taught both my friends and family to use a password manager. Personally, I only remember 4 passwords that i use locally, the other 632 are stored in keepassxc db.

Password reuse is rampant: nearly half of observed user logins are compromised

Related Stories