Our first line of defense against a cyber attack is our passwords. The problem is that your security is not always taken seriously as it should be. In that aspect, many users have poor practices regarding their passwords. Thus, it is quite common to reuse passwords or to use weak passwords that are easy to crack by brute force attacks. In this article we are going to see how a high percentage of compromised passwords are still in use.
Hacked keys increase
A report examined trends related to compromised data. In this report, researchers identified 1.7 billion compromised passwords, a 15% increase over 2020, and 13.8 billion recovered personally identifiable information records obtained from breaches in 2021.
Reused passwords have been the main attack vector in recent years, to which we have to add the growing threat of digital identity exposure. He also comments that his annual report shows that users still don’t take password security as seriously as they should. Furthermore, he adds that the account takeover threat is not implementing general improvements in user cybersecurity hygiene and that this is alarming given the prevalence of digital identity fraud.
The government sector was strongly represented in 2021, in relation to compromised passwords. In that regard, 611 breaches containing .gov email addresses were discovered. Furthermore, they also found 561,753 pairs of email address credentials and passwords from government agencies internationally.
As for the most common data obtained, they were names, dates of birth, national identification numbers or driver’s licenses, vehicle makes and models, number of children, smoking status, marital status, estimated income and position.
Password reuse
Today the average user has dozens of online accounts with a single sign-on and often reuses passwords. The report found that 64% of users with multiple compromised passwords reused passwords for multiple accounts. In that aspect, if we compare it with the report they did in 2021, an increase of 4 points can be seen. A worrying fact is the increase year after year in the reuse of passwords. This reflects the ease with which hackers can use compromised passwords to compromise multiple accounts. In this regard, it has been observed that:
- 82% of analyzed reused passwords were an exact match to a previous password.
- 70% of users linked to breaches were still using an exposed password.
You may be interested in knowing how long it takes to crack your password.
So users create their own keys
Undoubtedly, the reuse of passwords for several accounts has an impact on having many ballots so that they become compromised passwords. However, there is also another important factor that makes our password more likely to be violated. The report also identified a strong link to current events in choosing our passwords. Password creation was seen to be linked to numerous 2021 TV shows, movies, and series, as well as music, as well as pop and sports culture.
On the other hand, many users and businesses think they are protected from identity fraud by relying on a dark web monitoring service. Unfortunately, one thing they don’t realize is that it can take over a year before compromised passwords make it to the dark web for those services to find.
Recommendations to be protected
To adequately protect our accounts, we must comply with two very important aspects:
- Have a good password to access the service.
- Always enable two-step authentication for the service.
For the first, we must create an alphanumeric password with a length of 12 characters or more and mix numbers, uppercase, lowercase and symbols, to prevent our password from being in a password dictionary and being easily hacked. If you don’t want to generate it yourself, you can always use a tool like PasswordGenerator that will help you. Another aspect that you must take into account is password managers, these tools allow us to store all users and passwords securely, encrypting all the data contained, and accessing them through a master key that is the only one you must remember .
For the recommendation to enable two-step authentication, today most online services, prestigious websites, etc., have systems to configure the second authentication factor. If you are going to configure two-step authentication, you must do it with an authenticator application or with a USB device for authentication, it is not recommended to use SMS as a second authentication factor because they could make us a SIM Swapping and clone our SIM to steal this key send us.
Staying secure is quite easy with the right tools, which is why we recommend that you use a key manager like KeePass or Bitwarden, and always enable two-step authentication on your services, but without using SMS as a second authentication factor. .
