“Password use should become obsolete, and we should look for different ways to log into accounts,” CEO of security vendor Gurucul, Saryu Nayyar, told Lifewire via email.
The Problem With Passwords
In December, The Sun reported that the UK’s National Crime Agency (NCA) supplied over 500 million passwords to the popular Have I Been Pwned (HIBP) service, which it had uncovered during an investigation. HIBP enables users to check if their passwords have been leaked in a breach and are prone to abuse by hackers. According to HIBP’s founder, Troy Hunt, over 200 million of the passwords supplied by NCA didn’t already exist in the database. “It points to the sheer size of the problem, the problem being passwords, an archaic method of proving one’s bonafides. If there was ever a call to action to work towards eliminating passwords and finding alternatives, then this has to be it,” Baber Amin, COO of digital identity experts, Veridium told Lifewire via email, in response to the NCA’s recent contribution to HIPB. Amin added that leaked credentials don’t just compromise existing accounts, as hackers now use them with AI-based analytical tools to identify patterns of how an individual creates passwords. In essence, leaked credentials jeopardize the security of other non-compromised accounts as well.
Passwords and More
Advocating for a better protection mechanism than passwords, Nayyar suggests that users who have the option to set up multi-factor authentication on their accounts should do so. Ron Bradley, VP of Shared Assessments, a membership organization that helps develop best practices for third-party risk assurance, agrees. “Turn on multi-factor authentication everywhere possible, especially apps that move money.” Securing an account with a password alone is known as single-factor authentication. Multi-factor authentication or MFA builds on top of that and secures accounts by adding an extra step into the sign-in process by asking users for another piece of information. Many services, including several banks, implement MFA by sending a verification code to a user’s mobile number registered with the bank. However, this verification mechanism is prone to an attack mechanism known as a SIM swap attack, where attackers take control of a target’s mobile phone number by tricking the owner’s carrier into reassigning the number to the attacker’s SIM card. While acknowledging such an attack that targeted some of its customers, T-Mobile said that SIM swap attacks have become a common and industry-wide occurrence. Instead, a better option for enabling MFA is by using apps such as Duo Security, Google Authenticator, Authy, Microsoft Authenticator, and other such dedicated MFA apps.
Password Sprawl
However, all the cybersecurity experts we spoke to cautioned that using MFA shouldn’t be an excuse for not taking adequate steps to secure the passwords. “Be a part of the one-percenters that have no idea what their bank password is because it’s too long and complex,” advised Bradley. He adds that users should consider investing in a password manager when it comes to passwords. While there’s no shortage of free password managers, and there’s one built into your web browser as well, experts suggest that a free password manager is better than not having one at all, but users should exercise caution when using one. While investigating a recent breach of one company’s internal network, cybersecurity researchers from AhnLab discovered that the VPN account used to break into the company network was leaked from the PC of a remote working employee. This PC was infected with various malware, including one designed specifically to extract passwords from the password managers built into Chromium-based web browsers such as Google Chrome and Microsoft Edge. “Although the account credentials storing feature of browsers is very convenient, as there is a risk of leakage of account credentials upon malware infection, users are recommended to refrain from using it,” warn the AhnLab researchers.
