Cracking Forgotten Passwords

Schneier on Security

It's "useful for cracking passwords you kinda-remember." You tell the program what you remember about the password and it tries related passwords. cryptocurrency passwordsExpandpass is a string expansion program.

Forced Password Reset? Check Your Assumptions

Krebs on Security

Almost weekly now I hear from an indignant reader who suspects a data breach at a Web site they frequent that has just asked the reader to reset their password. Some are even checking for password re-use on all new account signups.

Default Password for GPS Trackers

Schneier on Security

Many GPS trackers are shipped with the default password 123456. We just need to eliminate default passwords. gps passwords trackingMany users don't change them. This is an easy win.

Risks of Password Managers

Schneier on Security

Stuart Schechter writes about the security risks of using a password manager. It's a good piece, and nicely discusses the trade-offs around password managers: which one to choose, which passwords to store in it, and so on. My own Password Safe is mentioned.

Pwned Passwords, Version 5

Troy Hunt

Almost 2 years ago to the day, I wrote about Passwords Evolved: Authentication Guidance for the Modern Era. Shortly after that blog post I launched Pwned Passwords with 306M passwords from previous breach corpuses. 3,768,890 passwords. Have I Been Pwned Pwned Passwords

The Risk of Weak Online Banking Passwords

Krebs on Security

If you bank online and choose weak or re-used passwords, there’s a decent chance your account could be pilfered by cyberthieves — even if your bank offers multi-factor authentication as part of its login process.

Google Stored Unhashed G Suite Passwords for Years

Data Breach Today

Passwords Remained Encrypted for Enterprise Users Google is notifying administrators and users of its business-oriented G Suite product that the company had been storing unhashed passwords for years because of a flaw in the platform.

Flipboard Resets Passwords After Database Intrusions

Data Breach Today

Hashed and Salted Usernames and Passwords Exposed News aggregator Flipboard has initiated a systemwide password reset affecting as many as 150 million users following two database intrusions.

Password Manager Weaknesses Revealed

Data Breach Today

The latest edition of the ISMG Security Report describes vulnerabilities found in popular password generator apps. Plus, the evolution of blockchain as a utility and a new decryptor for GandCrab ransomware

Report: Facebook Stored Millions of Passwords in Plaintext

Data Breach Today

Facebook Under Fresh Scrutiny Over How It Stored User Passwords Facebook has corrected an internal security issue that allowed the company to store millions of user passwords in plaintext that were then available to employees through an internal search tool

Password Managers Leave Crumbs in Memory, Researchers Warn

Data Breach Today

Popular Password Managers for Windows Fail to Tidy Up Before Locking Up Shop A security audit of popular password manager has revealed some concerning weaknesses. But the research shows that some password managers need to more thoroughly scrub data left in memory

Facebook Password, Email Contact Mishandling Worsens

Data Breach Today

Millions of Instagram Users Affected by Plain-Text Password Storage Two security issues disclosed by Facebook over the past month are worse than first thought, adding to a harrowing series of data-handling mishaps by the social network. Millions of Instagram users had their plain-text passwords stored, and 1.5

Introducing Continuous Password Protection for Active Directory

Data Breach Today

The Industry's 1st Active Directory Plugin That Helps Organizations Prevent Use of Compromised Passwords According to NIST 800-63b Guidelines With widespread use of Active Directory across industries and organizations of all sizes, it is frequently a target for bad actors who can use a cracking dictionary or exposed credentials to gain unauthorized access to an employee's account

Dell, Dunkin Donuts Reset Passwords After Incidents

Data Breach Today

The Impacts of Both Incidents Appear to Be Limited Dell and Dunkin Donuts have both initiated password resets after experiencing separate security incidents aimed at gaining access to customer accounts.

Slack Initiates Mass Password Reset

Threatpost

Breach Cloud Security Hacks Privacy 2015 incident credential harvesting data breach password reset security breach SlackMore victims of a 2015 credential-harvesting incident have come to light.

Hostinger Data Breach: 14M Customer Passwords, Personal Data at Risk

Threatpost

Hostinger said that unauthorized access to an internal API server exposed hashed passwords of 14 million customers. Breach Hacks 14 million api server breach data breach hashed password hostinger Password website

Breached Passwords Still in Use By Hundreds of Thousands

Threatpost

Breach Web Security breach compromised password data breach google PasswordMore than 300,000 users still utilize credentials that have been compromised - with people visiting video streaming and porn sites most at fault, Google found in a new study.

Facebook Password, Email Contact Mishandling Deepens

Data Breach Today

Millions of Instagram Users Affected by Plain-Text Password Storage Two security issues disclosed by Facebook over the past month are worse than first thought, adding to a harrowing series of data-handling mishaps by the social network. Millions of Instagram users had their plain-text passwords stored, and 1.5

Troy Hunt on Passwords

Schneier on Security

Troy Hunt has a good essay about why passwords are here to stay, despite all their security problems: This is why passwords aren't going anywhere in the foreseeable future and why [insert thing here] isn't going to kill them. authentication biometrics passwords

Twitter: We Goofed; Change Your Password Now

Data Breach Today

Passwords Inadvertently Saved to Log in Plaintext Format; Twitter Blames Bug Twitter has apologized after it discovered that it had been inadvertently storing users' passwords in plaintext in an internal log, potentially putting them at risk.

Eliminating the Burden of Periodic Password Reset for Active Directory

Data Breach Today

Examining Your Quarterly Password Reset Policy Most organizations are now actively moving to password policies that don't expire

Google Stored G Suite Passwords in Plaintext Since 2005

Threatpost

Google said it had stored G Suite enterprise users' passwords in plain text since 2005 marking a giant security faux pas. Cloud Security G Suite Gmail google google cloud google security Password password store plain text

War Declared on Default Passwords

Data Breach Today

and California are trying to ensure that as many IoT devices as possible will be out-of-the-box secure, for starters by not shipping with default passwords Initiatives in UK and California Aim to Deep-Six Poor IoT Security Practices With at least 20 billion new consumer devices set to be internet-connected by 2020, initiatives in the U.K.

Which are the worst passwords for 2018?

Security Affairs

Which are the worst passwords for 2018? SplashData report confirms that 123456 is the most used password for the 5th year in a row. Below the 2018 top 10 most used passwords are: 123456 password 123456789 12345678 12345 111111 1234567 sunshine qwerty iloveyou.

Sextortion Scam Wields Stolen Passwords, Demands Bitcoins

Data Breach Today

Attackers Send a Leaked Password as 'Proof' Victim Was Hacked Scammers behind an ongoing "sextortion" campaign have been emailing a legitimate password - likely from a publicly leaked list - to victims with a threat to release a compromising video of the recipient unless they pay up in bitcoins, Barracuda Networks warns

Party Like Every Day Is World Password Day

Data Breach Today

Cause for Celebration: Microsoft Stops Recommending Periodic Password Changes Every day needs to be password security day - attackers certainly aren't dormant the other 364 days of the year. But as World Password Day rolls around again, there's cause for celebration as Microsoft finally stops recommending periodic password changes

Over 600k GPS trackers left exposed online with a default password of ‘123456’

Security Affairs

600,000 GPS trackers left exposed online with a default password of ‘123456’ Avast researchers found at least 600,000 GPS trackers manufactured by a Chinese vendor that were exposed online with a default password of “123456.”

Google Analyzes Pilfered Password Reuse

Dark Reading

Password Checkup data shows some users still reuse their exposed passwords

Over 23 million breached accounts were using ‘123456’ as password

Security Affairs

A cyber survey conducted by the United Kingdom’s National Cyber Security Centre (NCSC) revealed that ‘123456’ is still the most hacked password. million user accounts worldwide were using ‘123456’ as password, while 7.7 SecurityAffairs – Top breached passwords, hacking).

A Password-Exposing Bug Was Purged From LastPass

WIRED Threat Level

Google Project Zero found and reported a flaw in the widely used password manager. Security Security / Cyberattacks and Hacks

Why Was Equifax So Stupid About Passwords?

Data Breach Today

Massive Credit Bureau Stored Users' Plaintext Passwords in Testing Environment Massive, well-resourced companies are still using live customer data - including their plaintext passwords - in testing environments, violating not just good development practices but also privacy laws.

Password Manager Firms Blast Back at ‘Leaky Password’ Revelations

Threatpost

Privacy Uncategorized Vulnerabilities 1Password Dashlane insecure memory KeePass LastPass Password password manager1Password, Dashlane, KeePass and LastPass each downplay what researchers say is a flaw in how the utilities manage memory.

Surprising Password Guidelines from NIST

Data Breach Today

NIST Cyber Security Framework NIST guidelines often become the foundation for best practice recommendations across the security industry and are incorporated into other standards

A Breach, or Just a Forced Password Reset?

Krebs on Security

Software giant Citrix Systems recently forced a password reset for many users of its Sharefile content collaboration service, warning it would be doing this on a regular basis in response to password-guessing attacks that target people who re-use passwords across multiple Web sites.

Bridging the Password Gap

Data Breach Today

Rachael Stockton of LastPass says that 81 percent of breaches are caused by weak or reused passwords. So, is it time to take a hard look at password management and consider adding some technology to the practice

Passwords Advice

Adam Shostack

Bruce Marshall has put together a comparison of OWASP ASVS v3 and v4 password requirements: OWASP ASVS 3.0 & 4.0 Comparison. This is useful in and of itself, and is also the sort of thing that more standards bodies should do, by default. It’s all too common to have a new standard come out without clear diffs. It’s all too common for new standards to build closely on other standards, without clearly saying what they’ve altered and why.

Kanye’s Password

Roger's Information Security

Everyone and his brother, inside of infosec and outside has been chortling at Kanye’s iPhone password. how dare you share that man’s password” (it was on CNN, its out there now). how dare you password shame Kanye, at least he has a password.”.

Citrix Confirms Password-Spraying Heist of Reams of Internal IP

Threatpost

Breach Cloud Security Hacks 6tb citrix cybersecurity controls data breach update data heist information theft intellectual property internal ip password sprayingSecurity experts say the attack stemmed from weak cybersecurity controls.

A Password Management Report Card

Dark Reading

New research on password management tools identifies the relative strengths and weaknesses of 12 competing offerings

Mozilla addresses “master password” security bypass flaw in Firefox

Security Affairs

The latest update released by Mozilla for Firefox patches a flaw in Firefox Password Manager that can be exploited to access stored passwords. fixes a vulnerability that can be exploited to bypass the master password in Firefox Password Manager and access stored passwords.