Troy Hunt

MAY 27, 2021

Both these announcements are being made at a time where Pwned Passwords is seeing unprecedented growth: Getting closer and closer to the 1B requests a month mark for @haveibeenpwned 's Pwned Passwords. Speaking of natural fits, Pwned Passwords is perfect for this model and that's why we're starting here.

Passwords 358

Passwords Accountability Cybercrime Authentication 358

Krebs on Security

MAY 7, 2022

Apple , Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. “I worry about forgotten password recovery for cloud accounts.”

Passwords 262

Passwords Authentication Accountability Mobile 262

Troy Hunt

NOVEMBER 14, 2018

Last week I wrote a couple of different pieces on passwords, firstly about why we're going to be stuck with them for a long time yet and then secondly, about how we all bear some responsibility for making good password choices. This week, I wanted to focus on going beyond passwords and talk about 2FA. It's a subset of MFA.

Passwords 256

Passwords Authentication Accountability Mobile 256

Krebs on Security

AUGUST 5, 2019

If you bank online and choose weak or re-used passwords, there’s a decent chance your account could be pilfered by cyberthieves — even if your bank offers multi-factor authentication as part of its login process. Crooks are constantly probing bank Web sites for customer accounts protected by weak or recycled passwords.

Banking 258

Banking Passwords Risk Accountability 258

Troy Hunt

SEPTEMBER 17, 2019

Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter. Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. This just feels wrong but I can’t come up with a strong argument against it.

Banking 234

Banking Passwords Accountability Authentication 234

Krebs on Security

JANUARY 7, 2020

Late last year saw the re-emergence of a nasty phishing tactic that allows the attacker to gain full access to a user’s data stored in the cloud without actually stealing the account password. I look at this and think, would I be more likely to type my password into a box or more likely to click a button that says ‘okay’?”

Phishing 276

Phishing Passwords Accountability Authentication 276

Daniel Miessler

MARCH 10, 2022

People are starting to get the fact that texts (SMS) are a weak form of multi-factor authentication (MFA). In that post we talked about 8 levels of password security, starting from using shared and weak passwords and going all the way up to passwordless. It completely changes how authentication is done.

Authentication 364

Authentication Phishing Passwords Accountability 364

The Last Watchdog

FEBRUARY 5, 2024

Implement strong password policies and multi-factor authentication to prevent unauthorized access. Diligently apply the latest security patches and updates provided by Microsoft to protect against known Exchange Server vulnerabilities. Robust access control. Comprehensive monitoring.

Risk 264

Risk Backups Software Education 264

Troy Hunt

AUGUST 29, 2023

Further, the passwords from the malware will shortly be searchable in the Pwned Passwords service which can either be checked online or via the API. Pwned Passwords is presently requested 5 and a half billion times each month to help organisations prevent people from using known compromised passwords.

Malware 324

Malware Passwords Password Management Antivirus 324

The Last Watchdog

DECEMBER 8, 2022

This overconfidence is cause for concern for many cybersecurity professionals as humans are the number one reason for breaches (how many of your passwords are qwerty or 1234five?). Only 33 percent consistently use two-factor authentication (2FA). Only 28 percent don’t use repeated passwords•Only 20 percent use a password manager.

Cybersecurity 203

Cybersecurity Passwords Password Management Ransomware 203

Krebs on Security

JULY 29, 2021

Every time there is another data breach, we are asked to change our password at the breached entity. Our continued reliance on passwords for authentication has contributed to one toxic data spill or hack after another.

Passwords 362

Passwords Password Management Phishing Scams 362

Troy Hunt

APRIL 5, 2023

In its simplest form, the illegal data marketplace has long involved the exchange of currency for personal records containing attributes such as email addresses, passwords, names, etc. We block known breached passwords. We implement two factor authentication. So, we (the good guys) adapt and build better defences.

Marketing 353

Marketing Passwords Authentication Accountability 353

eSecurity Planet

AUGUST 19, 2022

One new tactic hackers have been using is to steal cookies from current or recent web sessions to bypass multi-factor authentication (MFA). Even cloud infrastructures rely on cookies to authenticate their users. Browsers allow users to maintain authentication, remember passwords and autofill forms.

Authentication 142

Authentication Password Management Passwords Malware 142

Malwarebytes

JULY 2, 2021

I use the present tense on purpose as these attacks are almost certainly still ongoing. Some attacks used known vulnerabilities that allowed remote code execution (RCE), while others started by trying to identify valid credentials through password spraying. Aim for strong passwords, but plan for bad ones. Windows NT 10.0;

Passwords 139

Passwords Authentication Government VPN 139

Troy Hunt

FEBRUARY 4, 2024

That's not unprecedented, but this is: password: "$2y$10$B0EhY/bQsa5zUYXQ6J.NkunGvUfYeVOH8JM1nZwHyLPBagbVzpEM2", No way! Is that genuinely a bcrypt hash of my own password? Yep, that's exactly what it is : The Spoutible API enabled any user to retrieve the bcrypt hash of any other user's password.

Passwords 363

Passwords Accountability Backups Data breaches 363

Malwarebytes

NOVEMBER 29, 2023

A new study that examines the current state of password policies across the internet shows that many of the most popular websites allow users to create weak passwords. For the Georgia Tech study , the researchers designed an algorithm that automatically determined a website’s password policy.

Passwords 141

Passwords Password Management Authentication Internet 141

CyberSecurity Insiders

JULY 3, 2021

Identity and user authentication continue to be a concern for IT managers. It’s time to take a closer look at alternative identity management and authentication strategies. With a digital trust ecosystem in place, the user retains control of their credentials while being issued a unique identifier for authentication.

Authentication 140

Authentication Identity Theft Technology InfoSec 140

Security Boulevard

SEPTEMBER 25, 2023

Passwords present several pain points, both from a security and usability standpoint. The post Axiad and Okta Partner to Revolutionize Authentication with Phishing Resistant MFA appeared first on Axiad. Malicious actors can.

Authentication 105

Authentication Phishing Passwords 105

Troy Hunt

JANUARY 16, 2019

Collection #1 is a set of email addresses and passwords totalling 2,692,818,238 rows. In total, there are 1,160,253,228 unique combinations of email addresses and passwords. This is when treating the password as case sensitive but the email address as not case sensitive. There are 21,222,975 unique passwords. It'll be 99.x%

Data breaches 280

Data breaches Passwords Password Management Accountability 280

CyberSecurity Insiders

AUGUST 1, 2022

While verification and authentication are terms that are often used interchangeably, they are in fact two separate operations. Digital verification and authentication play a critical role in preventing fraud and cyberattacks. What is Identity Authentication? What are the Most Common Authentication Methods? Image Source.

Authentication 121

Authentication Passwords Technology Insurance 121

Malwarebytes

DECEMBER 12, 2023

As if password authentication’s coffin needed any more nails, researchers in the UK have discovered yet another way to hammer one in. For example, when typing a password, people will regularly hide their screen but will do little to obfuscate their keyboard’s sound. Did it work? Yes, even over Zoom.

Passwords 145

Passwords Artificial Intelligence Password Management Cybercrime 145

Thales Cloud Protection & Licensing

DECEMBER 2, 2021

What is Modern Authentication and Its Role in Achieving Zero Trust Security? The evolving business and technology landscape and the need for secure, yet convenient, ways of logging into applications are driving the quest for more effective authentication. From static authentication…. to dynamic, context based authentication.

Authentication 125

Authentication Passwords Risk Mobile 125

Krebs on Security

MAY 12, 2022

On May 8, KrebsOnSecurity received a tip that hackers obtained a username and password for an authorized user of esp.usdoj.gov , which is the Law Enforcement Inquiry and Alerts (LEIA) system managed by the DEA.

Government 302

Government Authentication Passwords Mobile 302

Duo's Security Blog

NOVEMBER 20, 2023

One piece of evidence to support this hypothesis is the low adoption of a basic security control that protects against identity-based attacks - multi-factor authentication (MFA). Add to this, the risks of weak authentication factors such as SMS one-time passcodes and dormant or inactive accounts.

Threat Detection 134

Threat Detection Authentication Accountability Data breaches 134

Malwarebytes

DECEMBER 12, 2023

As if password authentication’s coffin needed any more nails, researchers in the UK have discovered yet another way to hammer one in. For example, when typing a password, people will regularly hide their screen but will do little to obfuscate their keyboard’s sound. Did it work? Yes, even over Zoom.

Passwords 141

Passwords Artificial Intelligence Password Management Cybercrime 141

Troy Hunt

JULY 26, 2019

As the process unfolds I'll share more, but hopefully this will give you a little taste of what I'm going through at present. Shape Security is sponsoring my blog this week (Captcha is no longer enough, they're talking about how Shape Connect blocks automation & improves security instantly, with a 30 minute implementation).

Password Management 187

Password Management Passwords Authentication 187

IT Security Guru

OCTOBER 26, 2023

Security is crucial, but let’s face it, a password like “Fluffy123” won’t fool anyone for long. Enter Two-Factor Authentication, or 2FA for short. It’s a security method that requires you to present not one but two forms of ID before granting you access. With 2FA enabled, you’ll first enter your password.

Authentication 132

Authentication Passwords Mobile VPN 132

eSecurity Planet

SEPTEMBER 19, 2022

Since many people use the same passwords or patterns when generating passwords, hackers have more and more opportunities to gain access to sensitive company data. Password manager tools allow organizations and their employees to seamlessly and securely handle login credentials. Best Password Manager Tools.

Password Management 110

Password Management Passwords Software Encryption 110

Troy Hunt

OCTOBER 2, 2020

I asked for technical detail so I could validated the authenticity of his claim and the info duly arrived. The account takeover all began with the Grindr password reset page: I entered Scott's address, solved a Captcha and then received the following response: I've popped open the dev tools because the reset token in the response is key.

Accountability 363

Accountability Hacking Passwords InfoSec 363

eSecurity Planet

MAY 22, 2023

Security researchers recently published a paper detailing an attack they say can be used to bypass smartphone fingerprint authentication. An attack like BrutePrint could present a significant threat to passkeys , an increasingly popular way to replace passwords with authentication methods like fingerprint authentication or face recognition.

Authentication 108

Authentication Encryption Password Management Antivirus 108

Krebs on Security

MARCH 13, 2019

Pappachen said Sizmek forced a password reset on all internal employees (“a few hundred”), and that the company is scrubbing its SAS user database for departed employees, partners and vendors whose accounts may have been hijacked. ” PASSWORD SPRAYING. BRUTE-FORCE LIGHT.

Accountability 230

Accountability Passwords Advertising Penetration Testing 230

NetSpi Technical

NOVEMBER 14, 2024

For those interested in the previous PowerHuntShares release, here is the blog and presentation. Open cmd.exe and execute PowerShell or PowerShell ISE using the runas command so that network communication authenticates using a provided set of domain credentials. Charts, Graphs, Passwords & LLM Magic for PowerHuntShares 2.0

Passwords 145

Passwords Risk Data collection Backups 145

Krebs on Security

AUGUST 16, 2018

Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many banks and online services rely on text messages to send users a one-time code that needs to be entered in addition to a password for online authentication. On June 11, 2017, Terpin’s phone went dead.

Mobile 249

Mobile Cryptocurrency Accountability Authentication 249

Krebs on Security

APRIL 11, 2024

Both sources said the attackers used the S3 access to copy and exfiltrate several terabytes worth of Sisent customer data, which apparently included millions of access tokens, email account passwords, and even SSL certificates.

CISO 289

CISO Encryption Telecommunications Financial Services 289

SecureWorld News

JULY 17, 2024

The event not only showcases athletic prowess but also presents a significant challenge for cybersecurity professionals. It is essential to verify the authenticity of sources before clicking on links or providing personal information. As the 2024 Olympics approach, the world's eyes will turn to Paris.

Cybersecurity 114

Cybersecurity Phishing Mobile Media 114

Krebs on Security

AUGUST 3, 2020

A California company that helps telemarketing firms avoid getting sued for violating a federal law that seeks to curb robocalls has leaked the phone numbers, email addresses and passwords of all its customers, as well as the mobile phone numbers and other data on people who have hired lawyers to go after telemarketers.

Mobile 337

Mobile Marketing Consumer Protection Wireless 337

Duo's Security Blog

JUNE 1, 2023

Cybersecurity threats have evolved, and new challenges present themselves. These risks are just a stepping stone for the real prize, which is a local password repository or vault. The world has changed. How can organizations counter this threat?

Passwords 98

Passwords Social Engineering Data breaches Engineering 98