Vulnerabilities / Threats

5/1/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Password Reuse Abounds, New Survey Shows

Despite heightened awareness of the security implications many users still continue to reuse passwords and rarely if ever change them, a LogMeIn survey shows.

When it comes to the password behaviors of computer users, there's bad news and there's more bad news.

A new survey by LastPass by LogMeIn of some 2,000 individuals in the United States, Australia, France, Germany, and the UK has revealed what can only be described as broad apathy among a majority of users on the issue of password use.

Though 91% of the respondents profess to understand the risks of using the same passwords across multiple accounts, 59% said they did so anyway. For 61%, it is the fear of forgetfulness that was the primary reason for password reuse. Fifty percent say they reuse passwords across multiple accounts because they want to know and be in control of their passwords all the time.

The situation is equally depressing around the issue of password change. More than half - 53% - of the respondents confess to not changing their passwords in the past 12 months even though they were aware of the risks, and despite news of a data breach involving password compromise. Not only did nearly six in 10 of the users polled use the same password across accounts, they rarely if ever change the password over time. In fact, 15% of the respondents say they would rather do a household chore or sit in traffic (11%) than change their passwords.

Exacerbating the situation is the sheer number of online accounts that users have these days. Nearly eight in 10 (79%) of the LogMein survey takers have between one and 20 online accounts for work and personal use.

Forty-seven percent don't do anything differently when creating passwords for personal and work use; less than one-fifth (19%) create more secure passwords for work. A surprisingly high 62% reuse the same password for work and personal accounts.

The LogmeIn survey results are another reaffirmation of the notoriously poor password behaviors of online users. Previous studies have revealed a similarly lackadaisical attitude when it comes to selecting and managing passwords controlling access to online accounts.

Default and easily guessable passwords (12345 anyone?) have led to countless individual and corporate account takeovers and compromises in recent years, and prompted widespread calls for a move away from password-based authentication mechanisms altogether.

"I’d say the biggest surprise is that even though people are aware of the major cyberattacks and increases in costly data breaches, it's still not translating to better password security practices," says Sandor Palfy, CTO of identity and access management at LogMeIn.

Risky Business

This password neglect is creating huge risks and undermining overall security both for individual users and for employers. "The lesson for enterprises is most of their employees do not recognize the critical role that passwords have in protecting their personal and work information," Palfy says.

Many employees seem unaware or uncaring of the fact that weak passwords can potentially put the organization at risk, he says. "Enterprises need to rethink security policies and implement ways to centralize, automate, and securely store employee passwords."

The most common mistake that organizations can make is to underestimate the danger posed by weak passwords. The reality is that each password is like an entry point into the enterprise and needs to be secured like any other entry point. "Organizations need to take steps to both regularly educate and communicate password best practices to all employees, including how and why to use strong passwords," Palfy says.

Organizations also need to ensure they have the right password management tools and processes for enforcing strong password practices across the enterprise. "The organizations that can rapidly and effectively address that challenge are well-positioned to keep their businesses safe," Palfy notes.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
7/28/2018 | 12:48:44 PM
Re: Password "best practices" are the real problem.
A recent DR webinar ( Improving Enterprise Authentication ), points out some important points and positives concerning passwords.  This is from one slide:

Passwords - The Necessary Evil of Authentication

• Passwords are an individuals first and most prevalent interaction with security

• Negative impressions tend to stay with individuals 

• Passwords remain viable due to their ability to be changed, no need for extra technology, and ease of use 

•  Biometrics suffer from lack of changeability 

•  Token based solutions require user to have something with them at all times 

• Security professionals have created negative view and challenges associated with passwords 

•  Focused on impressions of threats instead of research supported evidence 

•  Implemented irrational complexity rules and requirements 

•  LophtCrack created password anxiety in late 1990's that still  persists today 

 

I'd note that in the article on which we're commenting, some of the same negative impressions are cited, such as: "The situation is equally depressing around the issue of password change."  I think that's, to some extent, perpetuating some misconceptions, or outdated assumptions, about best practices concerning passwords; namely that periodic change of passwords provides important security benefits. 

Most are aware of the downsides of frequent PW change, most notably that users are confronted with new generated passwords, or they are forced to create something new and memorable; and not just any password, but a "strong" password - that strength metric based largely on complexity - which makes creation more burdensome, and remembering more of a challenge.  An almost inevitable side effect (ought to be put on the warning label), of burdening users with this standard password vulnerability Rx, is to promote the far greater predisposition is password reuse.  So, the cure ends up doing more harm than the disease! 

Is frequent PW change a cure for what ails you (security-wise)?  Probably not; not when a strong attack can leverage the cracking power available today.  Will you force users to accept or create new strong passwords every day, every hour?  Even that won't be frequent enough in all cases. 

Also, does a password's strength reside in complexity (mix of different alphanumeric character types)?  I've seen studies where the principal protection resides in password length.  Anyone around long enough to remember when PW length first was stipulated (even, when you couldn't enter more than 8 characters), saw these "minimums" go from 4 to 6, to 8 to ...; and most users would use exactly the minimum - which meant to crackers that they knew the probable length of the passwords they needed to crack! 

Strength in numbers (number of characters in a PW), makes sense, as a variable (not all users will use the same large number), large number will drive up required processing power to crack, more than complexity.  Never forget that password reuse can provide a kind of wormhole through the security-spacetime continuum, allowing attackers to arrive at their destination in the blink of an eye. 

Adding in complexity helps; but not if that overburdens users, as will happen if you enforce frequent PW changing! 

I recommend only enforcing PW change when there is evidence of a data breach (another kind of wormhole through for attackers).  Lord help you if that happens every 30 days. 

Use passphrases, rather than passwords.  Phrases naturally tend to be longer than words, and more immune to dictionary-attacks; even ones factoring in the use of "$" for an "S", or "4" for (do I have to say it?).  Phrases without spaces between words are even better (less vulnerable, as the start and end of component words are not delineated), and aren't harder to remember.  Throw in some proper nouns, and you've really made things tough for crackers. 

Will such passphrases be invulnerable to the most powerful attacks?  No.  No surprise there.  But in targeting an organization with dozens, hundreds, thousands of users, who will ever be able to afford the resources to force all of them?  That's just what many attacks do: look for the weakest links, the low hanging fruit, the chinks in the armor....  If all your links are pretty darn strong, fruit high up in the tree - and without wormholes! - you'll be a lot safer than by enforcing assumed "best practices" from yesteryear. 

 
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
7/27/2018 | 2:47:59 PM
Mr. Monk: "Here's what happened"
Monk season 7, episode 11 (numerically lucky for me that I watched it), has the former SFPD detective solve a case based on his knowledge of motivations and patterns of human behavior.  When a researcher's bicycle is stolen, then tossed a few minutes after the theft, Monk realizes that it was the lock (digital, using a keypad to enter the unlocking code - with a secret keylogger incorporated in the design), that the thieves were after.  Monk (and the thieves), knew that if the bike's owner already used an 8 digit combination for a security door lock, he might well set the same sequence for an 8 digit bicycle lock given to him as a gift (from the thieves).  Far easier to remember one 8 digit number than two. 

I don't think it takes a great detective to see the parallels to password and PIN reuse.  While actual keyloggers are a threat, access to the user/password data of a low security (and perceived as inconsequential), website can provide better means to a rewarding end (and one that doesn't leave a physical or digital "paper trail"). 

The TV series ended before Monk provided viewers with his "best practices" for password use; but we've done pretty well thinking through some strategies which can get us at least part way towards an ultimate solution.  One more lesson we can take from episode 7/11 is that newfangled solutions which make things easier for us, might just make things easier for clever thieves - those with full faith in fingerprint or facial recognition authentication/authorization ought to spend a bit more time assessing their choice (at least a fraction of the time  next-gen thieves will on exploiting our overconfidence).  
DM3D
50%
50%
DM3D,
User Rank: Apprentice
5/7/2018 | 10:14:13 PM
References
Hi Jay, Thanks for the interesting article. When citing third party surveys and reports, would you mind provide references (ideally with direct links)? Best regards, David
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/1/2018 | 3:03:03 PM
Issue is compounded
This issue is compounded by the fact that passwords are a very weak form of authentication. This is why password retention and password complexity policies need to be invoked.
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Symantec Intros USB Scanning Tool for ICS Operators
Jai Vijayan, Freelance writer,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3988
PUBLISHED: 2018-12-10
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the...
CVE-2018-10008
PUBLISHED: 2018-12-10
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended...
CVE-2018-10008
PUBLISHED: 2018-12-10
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace br...
CVE-2018-10008
PUBLISHED: 2018-12-10
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jen...
CVE-2018-10008
PUBLISHED: 2018-12-10
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.