Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Authentication

2/6/2019
06:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

New Chrome Extension Takes Aim at Password Security

Google adds 'Password Checkup' feature that alerts users if their online credentials have been compromised.

A Google/Harris Poll released earlier this week on Safer Internet Day found that 52% of respondents reuse the same password for multiple – but not all – accounts, while another 13% reuse the same password for all of their accounts.

"When you take the two numbers together, you're looking at 65% who use the same passwords for multiple accounts," says Emily Schechter, product manager for Chrome security at Google.

As a result, Google this week released the Password Checkup extension for its Chrome browser, which warns users whether their credentials have been compromised. Web users can enable these new features by downloading the extension.

Wherever a user signs in, if the user name and password entered appears in a data breach known to Google, the person will receive an alert to reset the password. Password Checkup, developed in a partnership with Stanford University, was built with privacy in mind. According to Google, it never reports any identifying information about a user’s accounts, passwords, or devices. However, Google does report anonymous information about the number of lookups that surface an unsafe credential, whether an alert leads to a password change, and the domain involved for improving site coverage.

"We've developed technology that will alert you that the credentials are compromised without knowing what the credentials are," Schechter says. "We'll also only notify you about current user names and passwords. We gave this a lot of thought and want to avoid spamming people to the point where they get warning fatigue."

The Google/Harris Poll also reveals that just 24% of those surveyed use a password manager, and 69% give themselves an A or B when it comes to protecting their online accounts.

Avivah Litan, a vice president and distinguished analyst who focuses on security at Gartner, says the low usage numbers for password managers are not surprising.

"Password managers are easy to use once you get it," Litan says. "They can create more problems for users because all their passwords are now in one place. As of right now, they are too much for average users to manage."

Frank Dickson, a research vice president in IDC's Security Products research practice, thinks the industry needs to move toward eliminating the password.

"The average person handles something like 200 user names and passwords," he says. "I think we are expecting a lot for people to manage all those passwords and change them every three months."

Regarding the finding that 69% of respondents give themselves high marks on security, Gartner's Litan says consumers are naïve.

"There are keyloggers out there all the time and serious security threats that are not visible to consumers," Litan says. "Many think that they know how to look for phishing emails or they use a complicated password. ... The NSA isn't confident they can protect their online accounts, so how can consumers?”

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
0%
100%
REISEN1955,
User Rank: Ninja
2/7/2019 | 7:57:59 AM
Password - lazy treatment
Most users don't remember well so they think password 12345 (same as on my luggage - hat tip to Mel Brooks) are fine indeed.  Well, I use a hobby-based syntax - terms I will never forget and which can be assembled in many very unique patterns for difficult to crack passwords.  Two words plus a character and something split the word itself apart.   So not surprised that users in general are just lazy.  You deserve to be hacked if you use the same password on several accounts at one time.
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26246
PUBLISHED: 2020-12-03
Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.
CVE-2020-29279
PUBLISHED: 2020-12-02
PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
CVE-2020-29280
PUBLISHED: 2020-12-02
The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.
CVE-2020-29282
PUBLISHED: 2020-12-02
SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication.
CVE-2020-29283
PUBLISHED: 2020-12-02
An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parameter to getuser.php.