Feeds

Lazy password reuse opens Brits to crooks' penetration

With 26 to remember, some punters think up just 5

The Essential Guide to IT Transformation

The average Brit maintains 26 online accounts but only uses five different passwords to keep them secure.

A poll of 2,000 by Experian found that one in four people uses a single password for the majority of profiles, and one in 25 stick with the same one for ALL their accounts. In addition to chronic password reuse, failing to close unused accounts poses an addition privacy risk.

Two-thirds of those surveyed (66 per cent) copped to having defunct profiles which hold valuable personal and financial information – including social network profiles (26 per cent), email addresses (18 per cent) and shopping accounts (21 per cent).

Leaked personal information opens the doors to identity fraud, a crime suffered by an estimated two million UK citizens. About 90 per cent of the 12 million pieces of personal information illegally traded online globally between January and April this year involved password and login combinations, according to figures from Experian's identity web monitoring service.

Victims of identity fraud can have their credit histories thrashed while suffering the consequences of false loans run up in their name. Many victims remain ignorant that their ID has been stolen until they are refused loans, cards or mobe contracts, according to Experian.

Peter Turner, MD at Experian Consumer Services in the UK and Ireland, commented: "If password information is stolen from a website, all accounts using the same details will be compromised, and this information can spread among fraudsters rapidly."

Leaky logins in the news

Leaks of password data by one or another high-profile website have become everyday news over recent weeks. Last week alone news that Yahoo! Voices had spilled more than 450,000 login credentials was followed quickly by warnings about the loss of secured IDs from Nvidia's developer and user forums after password hashes were swiped. The Yahoo! Voices hack was the only one of the trio that directly exposed users' passwords, but even the less-serious Nvidia hack prompted the graphics chip firm to suspend its forums.

Other recent victims of consumer password security breaches have included Last.fm, eHarmony and LinkedIn.

Around 20 per cent of the passwords found on lists of compromised login credentials match those from Microsoft Accounts because of password reuse, according to a blog post by Microsoft on the issue.

Eric Doer, group programme manager at Microsoft, said: "These attacks... highlight the longstanding security advice to use unique passwords, as criminals have become increasingly sophisticated about taking a list of usernames and passwords from one service and then 'replaying' that list against other major account systems."

Experian argues that better password choices combined with the use of monitoring services (such as the one it supplies, of course), can address the problems passed by account hijacking. However other security experts argue that the survey illustrates the growing problems with using passwords as a security defence.

Carl Leonard, senior manager at Websense Security Labs, commented: "Passwords are simply not enough to protect vital data – they're as strong as a simple lock against professional thieves. Passwords can be guessed, cracked or stolen through social engineering.

"Worse still businesses can be attacked and stories of breached password databases make for uneasy reading. Businesses need to think carefully how they secure password information for which they are responsible – encrypting password records and securing the database makes good sense." ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.