Feeds

Lazy password reuse opens Brits to crooks' penetration

With 26 to remember, some punters think up just 5

Top 5 reasons to deploy VMware with Tegile

The average Brit maintains 26 online accounts but only uses five different passwords to keep them secure.

A poll of 2,000 by Experian found that one in four people uses a single password for the majority of profiles, and one in 25 stick with the same one for ALL their accounts. In addition to chronic password reuse, failing to close unused accounts poses an addition privacy risk.

Two-thirds of those surveyed (66 per cent) copped to having defunct profiles which hold valuable personal and financial information – including social network profiles (26 per cent), email addresses (18 per cent) and shopping accounts (21 per cent).

Leaked personal information opens the doors to identity fraud, a crime suffered by an estimated two million UK citizens. About 90 per cent of the 12 million pieces of personal information illegally traded online globally between January and April this year involved password and login combinations, according to figures from Experian's identity web monitoring service.

Victims of identity fraud can have their credit histories thrashed while suffering the consequences of false loans run up in their name. Many victims remain ignorant that their ID has been stolen until they are refused loans, cards or mobe contracts, according to Experian.

Peter Turner, MD at Experian Consumer Services in the UK and Ireland, commented: "If password information is stolen from a website, all accounts using the same details will be compromised, and this information can spread among fraudsters rapidly."

Leaky logins in the news

Leaks of password data by one or another high-profile website have become everyday news over recent weeks. Last week alone news that Yahoo! Voices had spilled more than 450,000 login credentials was followed quickly by warnings about the loss of secured IDs from Nvidia's developer and user forums after password hashes were swiped. The Yahoo! Voices hack was the only one of the trio that directly exposed users' passwords, but even the less-serious Nvidia hack prompted the graphics chip firm to suspend its forums.

Other recent victims of consumer password security breaches have included Last.fm, eHarmony and LinkedIn.

Around 20 per cent of the passwords found on lists of compromised login credentials match those from Microsoft Accounts because of password reuse, according to a blog post by Microsoft on the issue.

Eric Doer, group programme manager at Microsoft, said: "These attacks... highlight the longstanding security advice to use unique passwords, as criminals have become increasingly sophisticated about taking a list of usernames and passwords from one service and then 'replaying' that list against other major account systems."

Experian argues that better password choices combined with the use of monitoring services (such as the one it supplies, of course), can address the problems passed by account hijacking. However other security experts argue that the survey illustrates the growing problems with using passwords as a security defence.

Carl Leonard, senior manager at Websense Security Labs, commented: "Passwords are simply not enough to protect vital data – they're as strong as a simple lock against professional thieves. Passwords can be guessed, cracked or stolen through social engineering.

"Worse still businesses can be attacked and stories of breached password databases make for uneasy reading. Businesses need to think carefully how they secure password information for which they are responsible – encrypting password records and securing the database makes good sense." ®

Beginner's guide to SSL certificates

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.