---
title: "Account security"
canonical_url: https://www.janbrennenstuhl.eu/knowledge-base/account-security/
author: Jan Brennenstuhl
---

# Account security

What research says about password reuse, stolen credentials, strength meters, account recovery and account takeover.



## Entries

- [What should a password policy require?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/) (2026-10-13, guide): NIST SP 800-63B-4 sets a 15-character minimum for single-factor passwords, forbids composition rules and periodic changes, and requires blocklist checks and support for password managers. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/index.md
- [Do password strength meters work?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/) (2023-05-03, guide): Password strength meters produce stronger passwords when users change passwords on important accounts, but make no observable difference on unimportant ones. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/index.md
- [Do login challenges and risk scoring stop account takeover?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/) (2023-04-27, guide): Device-based login challenges block far more account takeover attempts than knowledge-based ones. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/index.md
- [How common is password reuse?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/) (2023-04-27, guide): Somewhere between 43% and 51% of users reuse the same password across multiple sites. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/index.md
- [How do you protect accounts from stolen credentials?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/) (2023-04-21, guide): Checking credentials against breach data and adding device and location risk signals to the login decision reduce the risk from stolen passwords. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/index.md
- [How secure are email-based password resets?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/) (2023-04-21, guide): 72% of the website account recovery mechanisms studied had at least one implementation weakness. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/index.md
- [How do attackers take over accounts?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/) (2023-04-21, guide): At least 35 of 75 popular online services studied were vulnerable to account pre-hijacking attacks. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/index.md