I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for not so important services. The problem comes when I forget the password of something that I do not recall how important that was for me.

If I entered all my four passwords (from weakest to strongest) in that website, and I still did not get access, how worried should I be that a website stores all my failed attempts and uses those passwords against me somehow? Is this a serious security concern for me?

  • 1
    Every time you use a password, even over https, you should assume it could be logged at the other end. Maybe some admin at their end started eavesdropping passwords, maybe their server logs get compromised. That's why you can never reuse passwords, with the sole exception of on your personal machines/systems that you manage yourself. Password management systems exist that keep local copies of unique passwords for each site, encrypts them with a memorized global passphrase. I highly recommend using a system like that. – dr jimbob Jul 7 '13 at 6:05

I have the problem that I usually use 4 passwords that I use quite often.

All of your other trouble stems from this. If you're concerned about security (and you should be) then stop it.

Is this a serious security concern for me?

Most definitely YES.

Whether this particular site discloses your information or whether one of your "important" sites gets hacked, this technique of yours can seriously bite you. Hackers expect you to re-use passwords on other sites, so they will definitely be looking for this behavior and definitely will try to exploit it. Your plan of having one password for "important" sites and one for "unimportant" sites is also common, so hackers will expect this as well.

You need to use different, unique passwords for all the sites you care about. One password used at paypal and nowhere else, one for each email account and nowhere else, etc.

I'd strongly recommend using a tool like KeePass or LastPass. Both rely on client-side encryption, so no secrets are ever visible to any third party.

  • This, a million times. Stop reusing passwords. Unique passwords per site is a solved problem. – Stephen Touset Jul 7 '13 at 4:07
  • I agree. a Password for every website will solve my entire problem. – M.C. Jul 7 '13 at 18:25
  • Don't you think that the problem with any password storing software is that the passwords are reversable. If the machine is infected it will leave all the passwords open to decryption. – jer.salamon Jul 8 '13 at 17:36
  • @jer.salamon password typically aren't encrypted, they're hashed. And hashing isn't reversible. You have to guess and check. – tylerl Jul 8 '13 at 18:55
  • @tylerl password software encrypts passwords so that they are reversible to be feed to the forms and applications that you input them into. Typically passwords stored in a database are hashed so they are not reversible. I am referring to the encryption of locally stored passwords in a password store application like KeePass or LastPass. – jer.salamon Sep 23 '13 at 21:22

I'd say "not very much" since wrong passwords are almost never stored: unless you failed to obtain login, the password that was right is usually a much juicier bit of information to grab.

It is recommended not to save wrong passwords in logs etc., since they might disclose the real password - even if you entered SqueamishOsprey, a human might guess the real password, and with things like THX138, a computer could do so all by itself by running a Levenshtein classification on a password dictionary.

A wrong password is usually:

  • the right password, spelled wrong (majority of the cases in my experience)
  • a password that was right but has now expired.
  • an old password which is no longer relevant, and never even was

Your case,

  • a current password for another service

is, I believe, even lower in likelihood. Anyone attempting to capture passwords would do so after they'd been validated, or would strive to garner information on their validity on that system, to reduce the burden of dealing with spurious passwords. In so doing, they'd discard yours.

Your risk scenarios are then, I think:

  • the wrong password is logged in cleartext, and the attacker succeeds in recovering the cleartext but does not or can not realize that the correct password in that system is another.
  • the wrong password is captured (together with the right ones) and sent for exploitation, even if such an exploitation would be much more powerful and/or quick if it weeded out the wrong passwords in the first place (this could happen, for example, if an exploited web site was coupled with a distributed exploitation network. Quickness in the exploitation would trump the need for precision).
  • the password interception is done in such a way that the attacker has no way of telling whether it's a good one or a mis-spelled one. He has to try them all. In some way the same interception also supplies enough details on your identity to allow selection of other viable services to gain access to.
  • the attack is directed at you (or all users of a small system) - in that case any password will do, and none would be discarded. There's no need for quickness since the victim pool is extremely small.

Personally, I feel that all the above scenario to be quite unlikely. Of course your evaluation might be different - depending on who you are, what's your net worth, where you work, and so on and so forth - all things I won't ask, on the off-chance that you might then have to kill me :-)


If there's a way to link your untrustworthy website's (Site A) account to your trustworthy website's (Site B) account, and you're entering Site B's password in Site A's login form, then you're potentially compromising your Site B account. This could be for one of many reasons, but here are the most common ones:

  • Rogue Site A operators who are intentionally logging all password inputs.
  • Incompetent Site A who are unintentionally logging passwords.
  • Site A isn't using HTTPS. (most likely)

I have casual accounts on nearly 50 forums, and only one or two of them uses HTTPS for their login forms. If someone is out to get your PayPal/email account, they'll MiTM and sniff you whenever they can to collect as much information as they can. Site B's password is somewhere sent in plaintext. Not A Good ThingTIM

Get rid of all this headache by using a password manager like KeePass.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.