Feeds

Lazy password reuse opens Brits to crooks' penetration

With 26 to remember, some punters think up just 5

Security for virtualized datacentres

The average Brit maintains 26 online accounts but only uses five different passwords to keep them secure.

A poll of 2,000 by Experian found that one in four people uses a single password for the majority of profiles, and one in 25 stick with the same one for ALL their accounts. In addition to chronic password reuse, failing to close unused accounts poses an addition privacy risk.

Two-thirds of those surveyed (66 per cent) copped to having defunct profiles which hold valuable personal and financial information – including social network profiles (26 per cent), email addresses (18 per cent) and shopping accounts (21 per cent).

Leaked personal information opens the doors to identity fraud, a crime suffered by an estimated two million UK citizens. About 90 per cent of the 12 million pieces of personal information illegally traded online globally between January and April this year involved password and login combinations, according to figures from Experian's identity web monitoring service.

Victims of identity fraud can have their credit histories thrashed while suffering the consequences of false loans run up in their name. Many victims remain ignorant that their ID has been stolen until they are refused loans, cards or mobe contracts, according to Experian.

Peter Turner, MD at Experian Consumer Services in the UK and Ireland, commented: "If password information is stolen from a website, all accounts using the same details will be compromised, and this information can spread among fraudsters rapidly."

Leaky logins in the news

Leaks of password data by one or another high-profile website have become everyday news over recent weeks. Last week alone news that Yahoo! Voices had spilled more than 450,000 login credentials was followed quickly by warnings about the loss of secured IDs from Nvidia's developer and user forums after password hashes were swiped. The Yahoo! Voices hack was the only one of the trio that directly exposed users' passwords, but even the less-serious Nvidia hack prompted the graphics chip firm to suspend its forums.

Other recent victims of consumer password security breaches have included Last.fm, eHarmony and LinkedIn.

Around 20 per cent of the passwords found on lists of compromised login credentials match those from Microsoft Accounts because of password reuse, according to a blog post by Microsoft on the issue.

Eric Doer, group programme manager at Microsoft, said: "These attacks... highlight the longstanding security advice to use unique passwords, as criminals have become increasingly sophisticated about taking a list of usernames and passwords from one service and then 'replaying' that list against other major account systems."

Experian argues that better password choices combined with the use of monitoring services (such as the one it supplies, of course), can address the problems passed by account hijacking. However other security experts argue that the survey illustrates the growing problems with using passwords as a security defence.

Carl Leonard, senior manager at Websense Security Labs, commented: "Passwords are simply not enough to protect vital data – they're as strong as a simple lock against professional thieves. Passwords can be guessed, cracked or stolen through social engineering.

"Worse still businesses can be attacked and stories of breached password databases make for uneasy reading. Businesses need to think carefully how they secure password information for which they are responsible – encrypting password records and securing the database makes good sense." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.