This field-guide entry has not been reviewed in its new form yet. The studies are summarized as published; no review date is implied.
Key findings #
Telemetry from nearly 670,000 users and 21 million logins showed that 1.5% of logins on the web involve breached credentials.
26% of breach warnings shown at login led users to switch to a new password at least as strong as the original.
Between 7% and 25% of passwords exposed through breaches, phishing kits and keyloggers matched the victim’s Google account.
In some contexts, the hash prefixes that common breach-checking services receive make remote guessing attacks 12 times more effective.
Evidence #
| Study | Year | Sample | Method | Finding |
|---|---|---|---|---|
| Protocols for Checking Compromised CredentialsCornell Tech, Cloudflare | 2019 | Existing C3 services (HaveIBeenPwned, Google Password Checkup) | Formal analysis, leakage simulation, protocol design | Hash-prefix leakage can make guessing 12 times more effective; 2 stronger protocols remain practical. |
| Protecting accounts from credential stuffing with password breach alertingGoogle, Stanford | 2019 | Over 4 billion breached credentials; nearly 670,000 users and 21 million logins | Protocol design, Chrome extension telemetry | 1.5% of logins involve breached credentials; 26% of warnings led to a new password. |
| Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen CredentialsGoogle, UC Berkeley, ICSI | 2017 | 1.9 billion breached credentials, 12.4 million phishing and 788,000 keylogger victims | Longitudinal measurement, March 2016 to March 2017 | 7-25% of exposed passwords matched the victim’s Google account. |
What to do #
For engineers #
- Check credentials against breach data at sign-up, password change and login. Use a protocol that never sends the password or its full hash to the checking service. Thomas et al. combine “computationally expensive hashing, k-anonymity, and private set intersection”; Li et al. show how much a plain hash prefix can leak.
- Don’t decide a login on the password alone. Thomas et al. (2017) show that risk signals such as a user’s historical geolocations and device profiles reduce the hijacking risk from stolen passwords. The reinforced authentication entry collects studies on login risk scoring.
- Watch for stuffing and spraying patterns across accounts, not only per account. See password spraying and honeytokens for detection ideas.
For product and UX #
- Tell users when their credentials appear in a breach, and make the next step a single action. In the Google study, 26% of warnings led to a new password that was at least as strong.
- Expect most users not to act on a warning alone. The password reuse entry covers what makes a notification work and where notifications fall short.
The studies in detail #
Protocols for Checking Compromised Credentials #
“To prevent credential stuffing attacks, industry best practice now proactively checks if user credentials are present in known data breaches.”
For this paper, researchers from Cornell Tech and Cloudflare analyzed existing compromised credential checking (C3) services such as HaveIBeenPwned and Google Password Checkup. They give the first formal description of C3 services, including operational requirements and threat models. Current services have the client share a short prefix of a password hash. The authors show that in some contexts this prefix makes remote guessing 12 times more effective. They then propose “two new protocols that provide stronger protection for users’ passwords”, implement them, and show that they remain practical to deploy.
Protecting accounts from credential stuffing with password breach alerting #
Researchers from Google and Stanford describe how Google’s password breach alerting works, which constraints and hard requirements it meets, and which cryptographic protocols it uses. Their cloud service covered over 4 billion breached credentials, and a Chrome extension served as the first client.
“Our protocol relies on a combination of computationally expensive hashing, k-anonymity, and private set intersection. Our approach improves on existing protocols by taking into account both an adversarial client and server, while also minimizing the chance of false positives.”
Anonymous telemetry from nearly 670,000 users and 21 million logins showed that 1.5% of logins on the web involved breached credentials. 26% of the warnings led users to migrate to a new password at least as strong as the original.
Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials #
Between March 2016 and March 2017, researchers from Google, UC Berkeley and the International Computer Science Institute identified 788,000 potential keylogger victims, 12.4 million potential phishing kit victims and 1.9 billion usernames and passwords exposed in data breaches. With this data, they “explore to what degree the stolen passwords […] enable an attacker to obtain a victim’s valid email credentials — and thus complete control of their online identity due to transitive trust”. In their case study of Google accounts, 7-25% of exposed passwords matched the victim’s Google account.
The study is from 2017, but its mitigation still applies today: the authors show that adding risk signals, such as a user’s historical geolocations and device profiles, to authentication helps mitigate hijacking with a correct but stolen password.