Password reuse across multiple sites creates major security risks. If an attacker can steal credentials and gain access to one account, he or she can also log into every other account that uses the same password. The threat doesn’t just apply to individuals, however. Employees using the same passwords at home and work put the entire enterprise at risk.

Facebook CSO Alex Stamos believes password reuse is the top cause of harm on the internet, according to CNET. When it comes to defending crown jewels against nefarious actors, passwords are a weak link.

The average individual has 150 online accounts protected by passwords, Dashlane reported in 2017. Combine that number with the fact that anywhere from 75 to 93 percent of users reuse passwords across multiple sites, according to a range of surveys conducted over the years, and the gravity of the issue becomes difficult to deny.

A New Approach to the Password Reuse Problem

In an effort to stamp out the bad habit of password reuse, two members of the computer science department at the University of North Carolina (UNC) at Chapel Hill proposed a new framework that would enable major web services to coordinate to ensure users don’t use the same passwords.

The authors considered the reality that a framework for password reuse is fraught with risks to users’ security and privacy. However, they asserted that technology can lend a solution to the problem and encouraged thought leaders to consider the benefits of a framework that “enables a server at which a user is setting a password, here called a requester, to ask of other websites, here called responders, whether the user has set a similar password at any of them.”

Neither website would have access to information that reveals the password itself, according to the proposal. The websites would only receive information alerting them to the similarities in the user’s passwords.

Consider single sign-on (SSO) technology, which allows a user to log into one application through his or her LinkedIn or Facebook account. Conceptually, the two websites are sharing information about the user — except, in this case, it’s in lieu of a password. The authors noted that SSO solutions mitigate the problem of password reuse by eliminating the need to create new login credentials.

A Flimsy Framework?

Best practices for cyber hygiene already call for users to create unique passwords for each site, so let’s imagine a scenario in which the proposed framework is implemented. Would behaviors really change?

Rishi Bhargava, co-founder of security operations provider Demisto, said that if sites were to start coordinating under this plan, they could do little more than perhaps alert users to instances of password reuse. If this happens across multiple sites, a user might grow so annoyed that he or she would start using a password manager or modify each password by one character. In other words, the framework would achieve very little.

Still, the likelihood of financial and retail sites going along with the proposal is slim, but the framework is just one of a number of efforts to better secure sites. Organizations and individuals should continue to use two-factor authentication (2FA), but it’s also critical to augment user training.

2FA and Biometrics Provide a More Practical Solution

From a security perspective, the issue is about whether passwords are keeping users safe online. Cybercriminals can use stolen credentials to gain access to multiple sites, so the proposal is a step in the right direction to some degree.

However, the framework has several issues, especially in the European Union (EU), where, according to the General Data Protection Regulations (GDPR), a password hash is considered personally identifiable information (PII). Passing the hash between services could allow a man-in-the-middle (MitM) attack, but it’s also important to note that EU citizens would need to consent to this transfer.

Still, proposing that two companies with PII belonging to millions of people should share information about their passwords seems a bit like the novel “1984.” What would George Orwell say? Surely other options exist.

Depending on the software provider for tools such as business email, people can use 2FA on dozens of third-party applications. A better solution might be to call for internet services to adopt better password and privileged access integration.

The recent IBM Future of Identity Study found that consumers are increasingly embracing biometrics as a viable solution to the password problem. Users are suffering from password fatigue, which is one reason why the proposed framework doesn’t do enough to solve the password problem. Still, the study revealed that password managers and biometrics do hold promise for the future.

Listen to the podcast: Millennials, Baby Boomers and the Future of Identity

More from Data Protection

Exploring DORA: How to manage ICT incidents and minimize cyber threat risks

3 min read - As cybersecurity breaches continue to rise globally, institutions handling sensitive information are particularly vulnerable. In 2024, the average cost of a data breach in the financial sector reached $6.08 million, making it the second hardest hit after healthcare, according to IBM's 2024 Cost of a Data Breach report. This underscores the need for robust IT security regulations in critical sectors.More than just a defensive measure, compliance with security regulations helps organizations reduce risk, strengthen operational resilience and enhance customer trust.…

Skills shortage directly tied to financial loss in data breaches

2 min read - The cybersecurity skills gap continues to widen, with serious consequences for organizations worldwide. According to IBM's 2024 Cost Of A Data Breach Report, more than half of breached organizations now face severe security staffing shortages, a whopping 26.2% increase from the previous year.And that's expensive. This skills deficit adds an average of $1.76 million in additional breach costs.The shortage spans both technical cybersecurity skills and adjacent competencies. Cloud security, threat intelligence analysis and incident response capabilities are in high demand. Equally…

Why safeguarding sensitive data is so crucial

4 min read - A data breach at virtual medical provider Confidant Health lays bare the vast difference between personally identifiable information (PII) on the one hand and sensitive data on the other.The story began when security researcher Jeremiah Fowler discovered an unsecured database containing 5.3 terabytes of exposed data linked to Confidant Health. The company provides addiction recovery help and mental health treatment in Connecticut, Florida, Texas and other states.The breach, first reported by WIRED, involved PII, such as patient names and addresses,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today