3

I understand that one should not use the same password everywhere, as stated here for instance.

Using the same password on several non-valuable sites may be considered acceptable: we simply do not care if they get compromised.

My question is about sites that I consider (wrongly?) as "very secure". I think it is very unlikely that my password would get compromised on Google, Github or Twitter for example.

Is it ok to use the same password for all these "secure" sites?

If that matters, suppose the password is very strong (>90 bits of entropy).

Improve this question
3
  • 1
    An answer would need to know wether those sites use password hashing and don't store plain passwords. If the password is strong, leakage of hashes doesn't break things whereas leakage of plaintext passwords breaks all accounts.
    – SEJPM
    Commented Jul 17, 2015 at 17:03
  • I think we can reasonably suppose that sites like Google do not store plain password, can't we?
    – Tom Cornebize
    Commented Jul 17, 2015 at 17:06
  • 1
    You can suppose that if you want to. Personally, I use a password manager and strong, unique passwords everywhere; then a compromise (of anything other than the password manager database and corresponding master passphrase) only ever affects a single account, and I don't need to determine whether a particular site is likely to follow security best practices or not.
    – user
    Commented Jul 17, 2015 at 17:20

3 Answers 3

Reset to default
6

Regardless of how secure any individual site/organization may or may not be the more places one uses the same password the more chances there are for unauthorized disclosure. A chain is only as strong as its weakest link.

Using unique passwords for each site isn't about the individual site's security. It's more about limiting your exposure should something happen to that password. Even if the sites themselves are perfect there are plenty of other ways passwords get compromised (key loggers, shoulder surfing, social engineering, ect...).

Yes maybe you use a password safe and are immune to all 3 of my examples but that's not the point. The point is that the more places that password is used the more possible exposure you open yourself up to. So the more places that same password was used the more places you have to change the password to and the more places you have to keep an eye on should your password be compromised.

Improve this answer
4

The equation involved in this goes like this:

enter image description here

..meaning if you have lets say n = 6 Sites, and given 5 of them are 99.9% secure while another has only 95% you get 0.99^5*0.95 = 0.9034405474049999 thus a already ~10% chance of possibly becoming fully compromised.

The weakest Link metaphor applies - though maybe there is no link between your accounts.

I suggest using a set of strong passwords and usernames, not necessarily independent from each other. XKCD threw a good story about easy-to-remember but still solid passwords.

Improve this answer
2

The problem is that by using the same password on all of these "secure" sites, if one of these "secure" sites gets compromised, then all of the other "secure" sites would be compromised as well, assuming you don't have any other security measures like 2-step authentication.

While you would hope that those large companies didn't store passwords in plaintext, look at Sony. A massive corporation and a huge plaintext offender.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .