3

In a specific situation: online stores that cannot possibly store payment details because you pay using paypal, but require registration. What reason is there to use good passwords here? Breaking into my account will only give access to my order history (assumed to be boring) and my address (realistically publicly available anyway).

If I'm using a good password manager synced across all devices I might want to access the site from, a strong random password that I never need to know is easy. If I'm not, why shouldn't I use "password"?

The paypal account is assumed to be using a strong password, of course.

Improve this question
6
  • Sounds like a site that doesn't necessarily even need to have a login. I shop at sites that don't require a login and pay with paypal as well. I suppose registering an account would benefit you an auto form fill maybe. If there is an option to not login, maybe avoid an account altogether and just use an advanced form filler.
    – Andrew Hoffman
    Jun 17, 2014 at 16:43
  • @AndrewHoffman, If there's a "checkout as guest" or "skip registration" I take it, but recently I've come across a few specialist shops that want me to generate a logon I may never even use again.
    – Chris H
    Jun 17, 2014 at 16:48
  • Then yeah I wouldn't worry about it either. Unless they sell chemicals and circuit boards.
    – Andrew Hoffman
    Jun 17, 2014 at 17:09
  • @AndrewHoffman, what's special about chemicals and circuit boards?
    – domen
    Jun 18, 2014 at 13:23
  • @domen don't want people buying bomb materials with your account :P
    – Andrew Hoffman
    Jun 18, 2014 at 17:59

5 Answers 5

Reset to default
3

By that logic you could just say "Why should I lock my door when I leave my house? Someone could just throw a brick through the window if they wanted in anyways"

Many people still do use weak passwords with websites, and although the data loss may be minimal in some cases, that doesn't mean you shouldn't take all the means necessary to protect your privacy. The information contained within these services could be used in any number of nefarious ways, not the least of which is your address.

  1. These transactions could be easily used as intelligence in a social engineering attack against you
  2. Many people will use the same password, or password methodology (ie linkedin123 for Linked in, gmail123 for Gmail) throughout the various websites they may be a member of. Learning these patterns can potentially lead to compromise.
  3. Different countries have different laws and regulations about the privacy of addresses and personal information which means that your address isn't necessarily "Public anyways"

Your privacy should always remain a top priority when using the internet and you should protect that privacy any way you know how.

Improve this answer
3
  • 3
    The logic about locking the door is spurious. It's more like "why should I bother locking my shed, it's only got broken plant pots in it?" The premise of the question is that they don't store anything of value to me. Data protection laws aside, in practice an address (and email address) are easy to find, so that really doesn't concern me. Your point about social engineering is a good one though - something along the lines of a fake product recall could be quite effective.
    – Chris H
    Jun 17, 2014 at 13:02
  • Fair enough re: lock analogy, yours is certainly better however the core point still holds true.
    – DKNUCKLES
    Jun 17, 2014 at 13:16
  • The main issue is the social engineering. If an attacker gets into the account and reads the purchase history, he can send you a very convincing email thanking for buying X for $Y, and offering a 95% discount on another purchase if you download and fill a rigged PDF form...
    – ThoriumBR
    Jan 8, 2018 at 14:33
5

The simple answer is that there isn't any reason to use a strong password in this case. Security is entirely about balancing risks and costs. The cost of a stronger password is that it is harder to remember and use. For low security sites, where there is either little risk of being compromised or little risk to being compromised, then it is perfectly fine to follow less stringent security measures.

The main thing is to make sure you are accurately judging the risk of your exposure, but if the risk is minimal, then the security can be too.

Improve this answer
1
  • 2
    And personally I'd just go ahead and gen the random password so that I don't need to remember that I used 'password' as my password. My password manager is so convenient, there is no reason not to use it. (as long as its a website)
    – Andrew Hoffman
    Jun 17, 2014 at 20:47
1

From your perspective:

You use a password to store something valuable. Something you do not consider to be private and public may not be stored without a password as you do not mind getting it out in the open. You should either use strong password or no password at all (this is not always possible as their are often enforced password policies).

From the perspective of Paypal:

Paypal is, by law, required to protect your privacy. This includes all personal data such as your address, phonenumber, etc. Therefore they require you to secure your own personal data. This is done by enforcing a strong password policy as some (probably most) users are not aware of the consequences of weak passwords. Enforcing the password policy is a form of "due dilligence" to protect their customers and to avoid that in lawsuits they get blamed for not informing the customer enough of using a weak password.

Improve this answer
1
  • I should probably have made it clearer in the question that the paypal account itself is well-protected. I'll edit that in.
    – Chris H
    Jun 17, 2014 at 12:59
1

If you are using a good password manager synced across all devices, then there is no problem in having a strong password for each site, even sites where password strength is not really needed. Why would you then use "password" as password ? With a really good password manager, you don't even have to choose or type the password at all...

As @Lucas points out, using a strong password is an easy way to remove liabilities on your part. If you use "password" as password, then, in case of some attack, the site owners may point at you and blame you for using a poor password. You know it would be unfair, and such blame would not be technically sound; and you could easily justify yourself; but that's still some effort. It is easier, in the long run, to systematically employ strong passwords everywhere (and, in particular, not to reuse passwords, ever). It gives you technical security where it matters, and the moral high ground in general.

Improve this answer
3
  • Could you elaborate on the attack you have in mind - would I, the user, lose out, or would the shop, and if so how? I'm really asking about the case where a password manager isn't used, or doesn't sync.
    – Chris H
    Jun 17, 2014 at 13:06
  • 1
    If an attack occurs, any kind of attack, many server admins will be likely to blame it on poor user passwords (regardless of whether this makes sense or not). Having a strong password is the surest way to protect yourself against slander from panicking incompetent admins.
    – Tom Leek
    Jun 17, 2014 at 13:15
  • 1
    Of course, if they know I've used a weak password, their security is inherently rubbish (almost certainly, I suppose they could compute the (salted) hashes of a set of bad passwords and see if mine is in the list).
    – Chris H
    Jun 17, 2014 at 13:20
0

If your name and address details are on the site, you're opening yourself up to identify fraud:

From ActionFraud:-

Identity theft is when your personal details are stolen and identity fraud is when those details are used to commit fraud

Identity theft happens when fraudsters access enough information about someone’s identity (such as their name, date of birth, current or previous addresses) to commit identity fraud.

Fraudsters can use your identity details to:

  • open bank accounts
  • obtain credit cards, loans and state benefits
  • order goods in your name
  • take over your existing accounts
  • take out mobile phone contracts
  • obtain genuine documents such as passports and driving licences in your name

If they can link your name to your address, and possibly phone numbers they are one step closer to spoofing your identity with an organisation. They could also make phising calls to you pretending to be your bank with some of this information. Yes, sometimes this information is publicly available but for the above reasons it is better to keep these details as private as possible.

If there are secure password managers that can sync across all your devices, why wouldn't you use such a tool to create a strong, random password for each site and stay as secure as you can?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .