0

This question already has an answer here:

Let's say there is a low quality website,myfirstblogwebsite.com, that stores user passwords in plain text. Someone could get hold of those passwords and try them out on websites like Gmail, Facebook, Amazon, banking websites, etc. Literally every person I know reuses their passwords so some will surely work.

  • Is this scheme common?
  • Is there a name for it?
  • What if the website is built by hackers specifically to collect users passwords for this purpose?

I'm paranoid about this every time I register on any lesser known website.

marked as duplicate by Adam Katz, forest, Serge Ballesta, Teun Vink, rox0r Aug 3 '18 at 15:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

4

It is known as credential stuffing, and it is becoming increasingly common due to the number and size of data breaches in recent years.

You are right to be concerned about password reuse. That, along with high entropy passwords/passphrases, are two very good reasons to start using a password manager.

2

I'd say you're right to be paranoid..and I can empathize to some degree with you about using lesser known sites, though that is the point I would disagree with- what you speak about isn't just exclusive to the low-quality, lesser-known sites of the world, and passwords don't need to be simply stored in plain text in order for them to be useful to an attacker for future endeavors.

What you are referring to is essentially a breach and data leak of sensitive information/PII, or personal identifiable information, read more here. One of the most recent examples of this happening at a large scale was the Equifax breach of 2017.

I also find the manner in which Equifax is allowing people to see if they've been compromised to be extremely ironic. Shown here, in order for Equifax to help you to determine if your information was in fact leaked they are requiring you to input your last name was well as the last 6-digits of your social security number.. I digress.

There are resources like Have I Been Pwned? by security researcher Troy Hunt that will check known email leak lists to help you determine if your email has been leaked during a breach.

And to your last point, these malicious websites exist and are quite common. There are a number of methods for how attackers can trick people into visiting their sites and divulging information but the overall scheme of this is known as Phishing. Much more can be said about this topic but this could be in the form of doppleganger websites, fake shopping websites advertising great deals and can even extend to ill-intended cryptocurrency token launch websites, etc.

Hopefully the above helps to suggest the importance of rotating passwords, not reusing passwords, and constantly being vigilant online!

Not the answer you're looking for? Browse other questions tagged or ask your own question.