Password reuse across multiple sites creates major security risks. If an attacker can steal credentials and gain access to one account, he or she can also log into every other account that uses the same password. The threat doesn’t just apply to individuals, however. Employees using the same passwords at home and work put the entire enterprise at risk.

Facebook CSO Alex Stamos believes password reuse is the top cause of harm on the internet, according to CNET. When it comes to defending crown jewels against nefarious actors, passwords are a weak link.

The average individual has 150 online accounts protected by passwords, Dashlane reported in 2017. Combine that number with the fact that anywhere from 75 to 93 percent of users reuse passwords across multiple sites, according to a range of surveys conducted over the years, and the gravity of the issue becomes difficult to deny.

A New Approach to the Password Reuse Problem

In an effort to stamp out the bad habit of password reuse, two members of the computer science department at the University of North Carolina (UNC) at Chapel Hill proposed a new framework that would enable major web services to coordinate to ensure users don’t use the same passwords.

The authors considered the reality that a framework for password reuse is fraught with risks to users’ security and privacy. However, they asserted that technology can lend a solution to the problem and encouraged thought leaders to consider the benefits of a framework that “enables a server at which a user is setting a password, here called a requester, to ask of other websites, here called responders, whether the user has set a similar password at any of them.”

Neither website would have access to information that reveals the password itself, according to the proposal. The websites would only receive information alerting them to the similarities in the user’s passwords.

Consider single sign-on (SSO) technology, which allows a user to log into one application through his or her LinkedIn or Facebook account. Conceptually, the two websites are sharing information about the user — except, in this case, it’s in lieu of a password. The authors noted that SSO solutions mitigate the problem of password reuse by eliminating the need to create new login credentials.

A Flimsy Framework?

Best practices for cyber hygiene already call for users to create unique passwords for each site, so let’s imagine a scenario in which the proposed framework is implemented. Would behaviors really change?

Rishi Bhargava, co-founder of security operations provider Demisto, said that if sites were to start coordinating under this plan, they could do little more than perhaps alert users to instances of password reuse. If this happens across multiple sites, a user might grow so annoyed that he or she would start using a password manager or modify each password by one character. In other words, the framework would achieve very little.

Still, the likelihood of financial and retail sites going along with the proposal is slim, but the framework is just one of a number of efforts to better secure sites. Organizations and individuals should continue to use two-factor authentication (2FA), but it’s also critical to augment user training.

2FA and Biometrics Provide a More Practical Solution

From a security perspective, the issue is about whether passwords are keeping users safe online. Cybercriminals can use stolen credentials to gain access to multiple sites, so the proposal is a step in the right direction to some degree.

However, the framework has several issues, especially in the European Union (EU), where, according to the General Data Protection Regulations (GDPR), a password hash is considered personally identifiable information (PII). Passing the hash between services could allow a man-in-the-middle (MitM) attack, but it’s also important to note that EU citizens would need to consent to this transfer.

Still, proposing that two companies with PII belonging to millions of people should share information about their passwords seems a bit like the novel “1984.” What would George Orwell say? Surely other options exist.

Depending on the software provider for tools such as business email, people can use 2FA on dozens of third-party applications. A better solution might be to call for internet services to adopt better password and privileged access integration.

The recent IBM Future of Identity Study found that consumers are increasingly embracing biometrics as a viable solution to the password problem. Users are suffering from password fatigue, which is one reason why the proposed framework doesn’t do enough to solve the password problem. Still, the study revealed that password managers and biometrics do hold promise for the future.

Listen to the podcast: Millennials, Baby Boomers and the Future of Identity

More from Data Protection

How data residency impacts security and compliance

3 min read - Every piece of your organization’s data is stored in a physical location. Even data stored in a cloud environment lives in a physical location on the virtual server. However, the data may not be in the location you expect, especially if your company uses multiple cloud providers. The data you are trying to protect may be stored literally across the world from where you sit right now or even in multiple locations at the same time. And if you don’t…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today