Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Authentication

2/6/2019
06:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

New Chrome Extension Takes Aim at Password Security

Google adds 'Password Checkup' feature that alerts users if their online credentials have been compromised.

A Google/Harris Poll released earlier this week on Safer Internet Day found that 52% of respondents reuse the same password for multiple – but not all – accounts, while another 13% reuse the same password for all of their accounts.

"When you take the two numbers together, you're looking at 65% who use the same passwords for multiple accounts," says Emily Schechter, product manager for Chrome security at Google.

As a result, Google this week released the Password Checkup extension for its Chrome browser, which warns users whether their credentials have been compromised. Web users can enable these new features by downloading the extension.

Wherever a user signs in, if the user name and password entered appears in a data breach known to Google, the person will receive an alert to reset the password. Password Checkup, developed in a partnership with Stanford University, was built with privacy in mind. According to Google, it never reports any identifying information about a user’s accounts, passwords, or devices. However, Google does report anonymous information about the number of lookups that surface an unsafe credential, whether an alert leads to a password change, and the domain involved for improving site coverage.

"We've developed technology that will alert you that the credentials are compromised without knowing what the credentials are," Schechter says. "We'll also only notify you about current user names and passwords. We gave this a lot of thought and want to avoid spamming people to the point where they get warning fatigue."

The Google/Harris Poll also reveals that just 24% of those surveyed use a password manager, and 69% give themselves an A or B when it comes to protecting their online accounts.

Avivah Litan, a vice president and distinguished analyst who focuses on security at Gartner, says the low usage numbers for password managers are not surprising.

"Password managers are easy to use once you get it," Litan says. "They can create more problems for users because all their passwords are now in one place. As of right now, they are too much for average users to manage."

Frank Dickson, a research vice president in IDC's Security Products research practice, thinks the industry needs to move toward eliminating the password.

"The average person handles something like 200 user names and passwords," he says. "I think we are expecting a lot for people to manage all those passwords and change them every three months."

Regarding the finding that 69% of respondents give themselves high marks on security, Gartner's Litan says consumers are naïve.

"There are keyloggers out there all the time and serious security threats that are not visible to consumers," Litan says. "Many think that they know how to look for phishing emails or they use a complicated password. ... The NSA isn't confident they can protect their online accounts, so how can consumers?”

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
REISEN1955
0%
100%
REISEN1955,
User Rank: Ninja
2/7/2019 | 7:57:59 AM
Password - lazy treatment
Most users don't remember well so they think password 12345 (same as on my luggage - hat tip to Mel Brooks) are fine indeed.  Well, I use a hobby-based syntax - terms I will never forget and which can be assembled in many very unique patterns for difficult to crack passwords.  Two words plus a character and something split the word itself apart.   So not surprised that users in general are just lazy.  You deserve to be hacked if you use the same password on several accounts at one time.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25596
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. T...
CVE-2020-25597
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. Howeve...
CVE-2020-25598
PUBLISHED: 2020-09-23
An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar...
CVE-2020-25599
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory a...
CVE-2020-25600
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains...