Lessons · Cybersecurity · credential stuffing and reused passwords

Credential stuffing: why one reused password is everybody's problem

When a password leaks from one site, attackers try the same email and password on every other site, automatically, and it works because people reuse them.

Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.

What it is for

The webmail log shows 40,000 login attempts in an hour from thousands of addresses, each trying one account once. Nobody guessed anything. They are replaying a list from somebody else's breach, and the accounts that fall are the ones whose owners reused a password.

How to think about it

Recognise the pattern: many sources, roughly one attempt each, a very low success rate, and the successes sitting on old accounts. The answer is not a stronger password; it is a different one per site, MFA, and checking new passwords against known-leaked lists.

Worked example

Log: 40,000 attempts, 3,100 source addresses, one try each

Not a brute force from one place. A list being replayed.

Successes: 212 logins, all on accounts unchanged for years

The reused passwords. This is what leaked somewhere else.

Rate: 212 / 40,000 = 0.53 per cent

Low, and still 212 accounts. Volume does the work.

Control: reset those 212, turn on MFA, one password per site

The stolen password becomes useless with a second factor.

Your turn

Write the habit that makes credential stuffing work at all.

the habit: password

The trap

Blaming password strength. A twenty-character password reused on a breached forum is a twenty-character key to your bank.

Practise credential stuffing and reused passwords on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.