Feeds

Lazy password reuse opens Brits to crooks' penetration

With 26 to remember, some punters think up just 5

Internet Security Threat Report 2014

The average Brit maintains 26 online accounts but only uses five different passwords to keep them secure.

A poll of 2,000 by Experian found that one in four people uses a single password for the majority of profiles, and one in 25 stick with the same one for ALL their accounts. In addition to chronic password reuse, failing to close unused accounts poses an addition privacy risk.

Two-thirds of those surveyed (66 per cent) copped to having defunct profiles which hold valuable personal and financial information – including social network profiles (26 per cent), email addresses (18 per cent) and shopping accounts (21 per cent).

Leaked personal information opens the doors to identity fraud, a crime suffered by an estimated two million UK citizens. About 90 per cent of the 12 million pieces of personal information illegally traded online globally between January and April this year involved password and login combinations, according to figures from Experian's identity web monitoring service.

Victims of identity fraud can have their credit histories thrashed while suffering the consequences of false loans run up in their name. Many victims remain ignorant that their ID has been stolen until they are refused loans, cards or mobe contracts, according to Experian.

Peter Turner, MD at Experian Consumer Services in the UK and Ireland, commented: "If password information is stolen from a website, all accounts using the same details will be compromised, and this information can spread among fraudsters rapidly."

Leaky logins in the news

Leaks of password data by one or another high-profile website have become everyday news over recent weeks. Last week alone news that Yahoo! Voices had spilled more than 450,000 login credentials was followed quickly by warnings about the loss of secured IDs from Nvidia's developer and user forums after password hashes were swiped. The Yahoo! Voices hack was the only one of the trio that directly exposed users' passwords, but even the less-serious Nvidia hack prompted the graphics chip firm to suspend its forums.

Other recent victims of consumer password security breaches have included Last.fm, eHarmony and LinkedIn.

Around 20 per cent of the passwords found on lists of compromised login credentials match those from Microsoft Accounts because of password reuse, according to a blog post by Microsoft on the issue.

Eric Doer, group programme manager at Microsoft, said: "These attacks... highlight the longstanding security advice to use unique passwords, as criminals have become increasingly sophisticated about taking a list of usernames and passwords from one service and then 'replaying' that list against other major account systems."

Experian argues that better password choices combined with the use of monitoring services (such as the one it supplies, of course), can address the problems passed by account hijacking. However other security experts argue that the survey illustrates the growing problems with using passwords as a security defence.

Carl Leonard, senior manager at Websense Security Labs, commented: "Passwords are simply not enough to protect vital data – they're as strong as a simple lock against professional thieves. Passwords can be guessed, cracked or stolen through social engineering.

"Worse still businesses can be attacked and stories of breached password databases make for uneasy reading. Businesses need to think carefully how they secure password information for which they are responsible – encrypting password records and securing the database makes good sense." ®

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.