Account security

Entries

1. What should a password policy require?

   Under NIST SP 800-63B-4, a password used on its own must have at least 15 characters, or 8 when it is one factor of multi-factor authentication, and systems should accept at least 64. Composition rules, forced periodic …

   Not yet reviewed
2. How do attackers take over accounts?

   Some attackers prepare an account before the victim even signs up: at least 35 of 75 popular services studied were vulnerable to such pre-hijacking. Others are paid to break into a specific account and mostly use …

   Not yet reviewed
3. How secure are email-based password resets?

   In a 2021 study of 366 websites from the Alexa Top 5K, 72% of account recovery mechanisms had at least one implementation weakness. Common gaps were multiple valid reset tokens, missing change notifications and …

   Not yet reviewed
4. How do you protect accounts from stolen credentials?

   Check usernames and passwords against breach data with a privacy-preserving protocol, and add risk signals such as known devices and locations to the login decision. Breached credentials show up in about 1.5% of logins …

   Not yet reviewed
5. How common is password reuse?

   Password reuse is very common. One study estimates that 43-51% of users reuse the same password across sites, and an in situ study found exact or partial reuse in about 60% of unique passwords. An attacker who holds a …

   Not yet reviewed
6. Do password strength meters work?

   Meters work under the right conditions. In one study they produced stronger passwords when people changed passwords on important accounts, and made no observable difference for an unimportant one. Many deployed meters …

   Not yet reviewed
7. Do login challenges and risk scoring stop account takeover?

   They are an important barrier if you pick the right challenge: device-based challenges blocked over 94% of phishing-rooted hijacking attempts at Google, while knowledge-based challenges stopped as few as 10%. The cost is …

   Not yet reviewed