Password reuse across multiple sites creates major security risks. If an attacker can steal credentials and gain access to one account, he or she can also log into every other account that uses the same password. The threat doesn’t just apply to individuals, however. Employees using the same passwords at home and work put the entire enterprise at risk.
Facebook CSO Alex Stamos believes password reuse is the top cause of harm on the internet, according to CNET. When it comes to defending crown jewels against nefarious actors, passwords are a weak link.
The average individual has 150 online accounts protected by passwords, Dashlane reported in 2017. Combine that number with the fact that anywhere from 75 to 93 percent of users reuse passwords across multiple sites, according to a range of surveys conducted over the years, and the gravity of the issue becomes difficult to deny.
A New Approach to the Password Reuse Problem
In an effort to stamp out the bad habit of password reuse, two members of the computer science department at the University of North Carolina (UNC) at Chapel Hill proposed a new framework that would enable major web services to coordinate to ensure users don’t use the same passwords.
The authors considered the reality that a framework for password reuse is fraught with risks to users’ security and privacy. However, they asserted that technology can lend a solution to the problem and encouraged thought leaders to consider the benefits of a framework that “enables a server at which a user is setting a password, here called a requester, to ask of other websites, here called responders, whether the user has set a similar password at any of them.”
Neither website would have access to information that reveals the password itself, according to the proposal. The websites would only receive information alerting them to the similarities in the user’s passwords.
Consider single sign-on (SSO) technology, which allows a user to log into one application through his or her LinkedIn or Facebook account. Conceptually, the two websites are sharing information about the user — except, in this case, it’s in lieu of a password. The authors noted that SSO solutions mitigate the problem of password reuse by eliminating the need to create new login credentials.
A Flimsy Framework?
Best practices for cyber hygiene already call for users to create unique passwords for each site, so let’s imagine a scenario in which the proposed framework is implemented. Would behaviors really change?
Rishi Bhargava, co-founder of security operations provider Demisto, said that if sites were to start coordinating under this plan, they could do little more than perhaps alert users to instances of password reuse. If this happens across multiple sites, a user might grow so annoyed that he or she would start using a password manager or modify each password by one character. In other words, the framework would achieve very little.
Still, the likelihood of financial and retail sites going along with the proposal is slim, but the framework is just one of a number of efforts to better secure sites. Organizations and individuals should continue to use two-factor authentication (2FA), but it’s also critical to augment user training.
2FA and Biometrics Provide a More Practical Solution
From a security perspective, the issue is about whether passwords are keeping users safe online. Cybercriminals can use stolen credentials to gain access to multiple sites, so the proposal is a step in the right direction to some degree.
However, the framework has several issues, especially in the European Union (EU), where, according to the General Data Protection Regulations (GDPR), a password hash is considered personally identifiable information (PII). Passing the hash between services could allow a man-in-the-middle (MitM) attack, but it’s also important to note that EU citizens would need to consent to this transfer.
Still, proposing that two companies with PII belonging to millions of people should share information about their passwords seems a bit like the novel “1984.” What would George Orwell say? Surely other options exist.
Depending on the software provider for tools such as business email, people can use 2FA on dozens of third-party applications. A better solution might be to call for internet services to adopt better password and privileged access integration.
The recent IBM Future of Identity Study found that consumers are increasingly embracing biometrics as a viable solution to the password problem. Users are suffering from password fatigue, which is one reason why the proposed framework doesn’t do enough to solve the password problem. Still, the study revealed that password managers and biometrics do hold promise for the future.
Listen to the podcast: Millennials, Baby Boomers and the Future of Identity