Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Authentication

2/6/2019
06:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

New Chrome Extension Takes Aim at Password Security

Google adds 'Password Checkup' feature that alerts users if their online credentials have been compromised.

A Google/Harris Poll released earlier this week on Safer Internet Day found that 52% of respondents reuse the same password for multiple – but not all – accounts, while another 13% reuse the same password for all of their accounts.

"When you take the two numbers together, you're looking at 65% who use the same passwords for multiple accounts," says Emily Schechter, product manager for Chrome security at Google.

As a result, Google this week released the Password Checkup extension for its Chrome browser, which warns users whether their credentials have been compromised. Web users can enable these new features by downloading the extension.

Wherever a user signs in, if the user name and password entered appears in a data breach known to Google, the person will receive an alert to reset the password. Password Checkup, developed in a partnership with Stanford University, was built with privacy in mind. According to Google, it never reports any identifying information about a user’s accounts, passwords, or devices. However, Google does report anonymous information about the number of lookups that surface an unsafe credential, whether an alert leads to a password change, and the domain involved for improving site coverage.

"We've developed technology that will alert you that the credentials are compromised without knowing what the credentials are," Schechter says. "We'll also only notify you about current user names and passwords. We gave this a lot of thought and want to avoid spamming people to the point where they get warning fatigue."

The Google/Harris Poll also reveals that just 24% of those surveyed use a password manager, and 69% give themselves an A or B when it comes to protecting their online accounts.

Avivah Litan, a vice president and distinguished analyst who focuses on security at Gartner, says the low usage numbers for password managers are not surprising.

"Password managers are easy to use once you get it," Litan says. "They can create more problems for users because all their passwords are now in one place. As of right now, they are too much for average users to manage."

Frank Dickson, a research vice president in IDC's Security Products research practice, thinks the industry needs to move toward eliminating the password.

"The average person handles something like 200 user names and passwords," he says. "I think we are expecting a lot for people to manage all those passwords and change them every three months."

Regarding the finding that 69% of respondents give themselves high marks on security, Gartner's Litan says consumers are naïve.

"There are keyloggers out there all the time and serious security threats that are not visible to consumers," Litan says. "Many think that they know how to look for phishing emails or they use a complicated password. ... The NSA isn't confident they can protect their online accounts, so how can consumers?”

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
REISEN1955
0%
100%
REISEN1955,
User Rank: Ninja
2/7/2019 | 7:57:59 AM
Password - lazy treatment
Most users don't remember well so they think password 12345 (same as on my luggage - hat tip to Mel Brooks) are fine indeed.  Well, I use a hobby-based syntax - terms I will never forget and which can be assembled in many very unique patterns for difficult to crack passwords.  Two words plus a character and something split the word itself apart.   So not surprised that users in general are just lazy.  You deserve to be hacked if you use the same password on several accounts at one time.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8720
PUBLISHED: 2020-08-13
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
CVE-2020-12300
PUBLISHED: 2020-08-13
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-12301
PUBLISHED: 2020-08-13
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-7307
PUBLISHED: 2020-08-13
Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.
CVE-2020-8679
PUBLISHED: 2020-08-13
Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.