Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same password is used on, or even if the same password is used anywhere again at all!

For example if the database to hotmail.com is compromised and the attacker now wants to compromise yahoo.com, it seems unlikely that he would harvest usernames on yahoo.com and try each one of the compromised passwords from hotmail.com on each username on yahoo.com. So can anyone illustrate to me a scenario where this would aid an attacker if the same password was used more than once?

share|improve this question
    
Especially when you're using your default password with your compromised and corresponding email account. Seems to be a complimentary ticket for me... –  knox Feb 16 at 9:53

4 Answers 4

up vote 2 down vote accepted

Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same password is used on, or even if the same password is used anywhere again at all!

Why does he need to know? If he has a set of usernames and passwords, how will it hurt to try the set against common sites like Facebook, Twitter, Gmail etc? What are the odds of someone using the same password but different usernames?

Yes, it is bad practice. Use strong, random and unique passwords for each site.

share|improve this answer
    
"What are the odds of someone using the same password but different usernames?" what do you mean? If it's a common password or a week one there is a good chance another person would use this password. On the other hand there are people who do use the same passwords for everything. –  Celeritas Feb 16 at 9:54
    
Once a password is publicly revealed (i.e. on a security forum), it is forever going to be included in big cracking dictionaries, and used against future password breaches in rules-based dictionary attacks. –  Anti-weakpasswords Feb 20 at 3:04

You need to consider how important each of these accounts is to you.

Most Internet users have a large number of low value accounts, created perhaps to comment on a blog or post once on a forum. Using a single low-value password on all these accounts is acceptable. I wouldn't say it's good practice, but it is acceptable.

If an attacker gets your password, they don't know for sure where else it is used, but they can have a guess. So many people use Google, Facebook, Twitter, eBay, etc that these are all a good bet. Maybe the user name is the same on all, but if not, often you can login using the email address, or use the "forgotten user name" feature to find it out.

And that is why you should not share passwords for accounts that you care about.

share|improve this answer

The attacker has no reason not to try. If user data on one site (which pretty much always includes username and a (possibly hashed) password is compromised, then an attacker will assume that the user may have used the same credentials.

Who cares if the user may not have. The attacker isn't limited to one guess and it is a great first guess that will work for many users.

This is why every breach notification suggests you change your password on other sites that have the same password.

For each individual user the chance of having an account at the next target may be low, however when trying hundreds of thousands of accounts there are going to be hits.

share|improve this answer

Even if the passwords to a site are compromised the attacker still doesn't know the user names

Actually 99% of times he WILL know the username, because they are stored together.

How is the login program supposed to validate the password against a username if they are not matched in some way? Also, think about a forum: even if I hypotetically grab only the passwords, and even if there are 10.000 users in the forum, how much time do you think it will require me to scrape usernames from the messages in the forum (often there is also a user list function) and match them?

or sites the same password is used on,

A cracker will just try common sites (social networks, forums, common banks..). The odds of finding the same login on another site are way more than you seem to think.

or even if the same password is used anywhere again at all!

He will try anyway, nothing to lose in doing so.

The point is that usernames are not private, while passwords are. If you get to the passwords, it is easy to get also the usernames.

share|improve this answer
    
But the same username may not be used on another site –  Celeritas Feb 19 at 5:56
    
Yeah, but it is very rare.And attackers work on big numbers, as said in other answers. Also, consider that email addresses are often used as usernames, and users don't want to have a different email address for every web site to which they are registered. –  sox Feb 19 at 23:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.