Feeds

Lazy password reuse opens Brits to crooks' penetration

With 26 to remember, some punters think up just 5

Using blade systems to cut costs and sharpen efficiencies

The average Brit maintains 26 online accounts but only uses five different passwords to keep them secure.

A poll of 2,000 by Experian found that one in four people uses a single password for the majority of profiles, and one in 25 stick with the same one for ALL their accounts. In addition to chronic password reuse, failing to close unused accounts poses an addition privacy risk.

Two-thirds of those surveyed (66 per cent) copped to having defunct profiles which hold valuable personal and financial information – including social network profiles (26 per cent), email addresses (18 per cent) and shopping accounts (21 per cent).

Leaked personal information opens the doors to identity fraud, a crime suffered by an estimated two million UK citizens. About 90 per cent of the 12 million pieces of personal information illegally traded online globally between January and April this year involved password and login combinations, according to figures from Experian's identity web monitoring service.

Victims of identity fraud can have their credit histories thrashed while suffering the consequences of false loans run up in their name. Many victims remain ignorant that their ID has been stolen until they are refused loans, cards or mobe contracts, according to Experian.

Peter Turner, MD at Experian Consumer Services in the UK and Ireland, commented: "If password information is stolen from a website, all accounts using the same details will be compromised, and this information can spread among fraudsters rapidly."

Leaky logins in the news

Leaks of password data by one or another high-profile website have become everyday news over recent weeks. Last week alone news that Yahoo! Voices had spilled more than 450,000 login credentials was followed quickly by warnings about the loss of secured IDs from Nvidia's developer and user forums after password hashes were swiped. The Yahoo! Voices hack was the only one of the trio that directly exposed users' passwords, but even the less-serious Nvidia hack prompted the graphics chip firm to suspend its forums.

Other recent victims of consumer password security breaches have included Last.fm, eHarmony and LinkedIn.

Around 20 per cent of the passwords found on lists of compromised login credentials match those from Microsoft Accounts because of password reuse, according to a blog post by Microsoft on the issue.

Eric Doer, group programme manager at Microsoft, said: "These attacks... highlight the longstanding security advice to use unique passwords, as criminals have become increasingly sophisticated about taking a list of usernames and passwords from one service and then 'replaying' that list against other major account systems."

Experian argues that better password choices combined with the use of monitoring services (such as the one it supplies, of course), can address the problems passed by account hijacking. However other security experts argue that the survey illustrates the growing problems with using passwords as a security defence.

Carl Leonard, senior manager at Websense Security Labs, commented: "Passwords are simply not enough to protect vital data – they're as strong as a simple lock against professional thieves. Passwords can be guessed, cracked or stolen through social engineering.

"Worse still businesses can be attacked and stories of breached password databases make for uneasy reading. Businesses need to think carefully how they secure password information for which they are responsible – encrypting password records and securing the database makes good sense." ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.