Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?
7
-
Can we assume that you mean web services and not corporate accounts?– schroeder ♦Nov 22, 2019 at 19:48
-
Have you looked this up? I'm finding hits ... zdnet.com/article/…– schroeder ♦Nov 22, 2019 at 19:49
-
That google study is only if a user attempts to use a previously compromised password, not whether or not they changed it after they had been notified that their personal account credentials were compromised. Yes this is all in reference to web services.– john doeNov 22, 2019 at 19:53
-
I'm not sure how you are concluding that. The Google paper is about changes after being notified, as tracked by their extension.– schroeder ♦Nov 22, 2019 at 20:27
-
I'd hope that it would be a best practice for the provider to force users to pick a different password - to actually compare old and new and require that the new password be different, as a one-time assurance activity (at which point the answer to your question would be a cheery "100%!" ;) But I can see why some orgs might choose otherwise, though.– Royce WilliamsNov 22, 2019 at 21:48
|
Show 2 more comments