Is it bad practice to use the same password on different sites?

Question

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same password is used on, or even if the same password is used anywhere again at all!

For example if the database to hotmail.com is compromised and the attacker now wants to compromise yahoo.com, it seems unlikely that he would harvest usernames on yahoo.com and try each one of the compromised passwords from hotmail.com on each username on yahoo.com. So can anyone illustrate to me a scenario where this would aid an attacker if the same password was used more than once?

Answer 1

Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same password is used on, or even if the same password is used anywhere again at all!

Why does he need to know? If he has a set of usernames and passwords, how will it hurt to try the set against common sites like Facebook, Twitter, Gmail etc? What are the odds of someone using the same password but different usernames?

Yes, it is bad practice. Use strong, random and unique passwords for each site.

Answer 2

You need to consider how important each of these accounts is to you.

Most Internet users have a large number of low value accounts, created perhaps to comment on a blog or post once on a forum. Using a single low-value password on all these accounts is acceptable. I wouldn't say it's good practice, but it is acceptable.

If an attacker gets your password, they don't know for sure where else it is used, but they can have a guess. So many people use Google, Facebook, Twitter, eBay, etc that these are all a good bet. Maybe the user name is the same on all, but if not, often you can login using the email address, or use the "forgotten user name" feature to find it out.

And that is why you should not share passwords for accounts that you care about.

Answer 3

The attacker has no reason not to try. If user data on one site (which pretty much always includes username and a (possibly hashed) password is compromised, then an attacker will assume that the user may have used the same credentials.

Who cares if the user may not have. The attacker isn't limited to one guess and it is a great first guess that will work for many users.

This is why every breach notification suggests you change your password on other sites that have the same password.

For each individual user the chance of having an account at the next target may be low, however when trying hundreds of thousands of accounts there are going to be hits.

Answer 4

Even if the passwords to a site are compromised the attacker still doesn't know the user names

Actually 99% of times he WILL know the username, because they are stored together.

How is the login program supposed to validate the password against a username if they are not matched in some way? Also, think about a forum: even if I hypotetically grab only the passwords, and even if there are 10.000 users in the forum, how much time do you think it will require me to scrape usernames from the messages in the forum (often there is also a user list function) and match them?

or sites the same password is used on,

A cracker will just try common sites (social networks, forums, common banks..). The odds of finding the same login on another site are way more than you seem to think.

or even if the same password is used anywhere again at all!

He will try anyway, nothing to lose in doing so.

The point is that usernames are not private, while passwords are. If you get to the passwords, it is easy to get also the usernames.