Vulnerabilities / Threats

5/1/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Password Reuse Abounds, New Survey Shows

Despite heightened awareness of the security implications many users still continue to reuse passwords and rarely if ever change them, a LogMeIn survey shows.

When it comes to the password behaviors of computer users, there's bad news and there's more bad news.

A new survey by LastPass by LogMeIn of some 2,000 individuals in the United States, Australia, France, Germany, and the UK has revealed what can only be described as broad apathy among a majority of users on the issue of password use.

Though 91% of the respondents profess to understand the risks of using the same passwords across multiple accounts, 59% said they did so anyway. For 61%, it is the fear of forgetfulness that was the primary reason for password reuse. Fifty percent say they reuse passwords across multiple accounts because they want to know and be in control of their passwords all the time.

The situation is equally depressing around the issue of password change. More than half - 53% - of the respondents confess to not changing their passwords in the past 12 months even though they were aware of the risks, and despite news of a data breach involving password compromise. Not only did nearly six in 10 of the users polled use the same password across accounts, they rarely if ever change the password over time. In fact, 15% of the respondents say they would rather do a household chore or sit in traffic (11%) than change their passwords.

Exacerbating the situation is the sheer number of online accounts that users have these days. Nearly eight in 10 (79%) of the LogMein survey takers have between one and 20 online accounts for work and personal use.

Forty-seven percent don't do anything differently when creating passwords for personal and work use; less than one-fifth (19%) create more secure passwords for work. A surprisingly high 62% reuse the same password for work and personal accounts.

The LogmeIn survey results are another reaffirmation of the notoriously poor password behaviors of online users. Previous studies have revealed a similarly lackadaisical attitude when it comes to selecting and managing passwords controlling access to online accounts.

Default and easily guessable passwords (12345 anyone?) have led to countless individual and corporate account takeovers and compromises in recent years, and prompted widespread calls for a move away from password-based authentication mechanisms altogether.

"I’d say the biggest surprise is that even though people are aware of the major cyberattacks and increases in costly data breaches, it's still not translating to better password security practices," says Sandor Palfy, CTO of identity and access management at LogMeIn.

Risky Business

This password neglect is creating huge risks and undermining overall security both for individual users and for employers. "The lesson for enterprises is most of their employees do not recognize the critical role that passwords have in protecting their personal and work information," Palfy says.

Many employees seem unaware or uncaring of the fact that weak passwords can potentially put the organization at risk, he says. "Enterprises need to rethink security policies and implement ways to centralize, automate, and securely store employee passwords."

The most common mistake that organizations can make is to underestimate the danger posed by weak passwords. The reality is that each password is like an entry point into the enterprise and needs to be secured like any other entry point. "Organizations need to take steps to both regularly educate and communicate password best practices to all employees, including how and why to use strong passwords," Palfy says.

Organizations also need to ensure they have the right password management tools and processes for enforcing strong password practices across the enterprise. "The organizations that can rapidly and effectively address that challenge are well-positioned to keep their businesses safe," Palfy notes.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DM3D
50%
50%
DM3D,
User Rank: Apprentice
5/7/2018 | 10:14:13 PM
References
Hi Jay, Thanks for the interesting article. When citing third party surveys and reports, would you mind provide references (ideally with direct links)? Best regards, David
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/1/2018 | 3:03:03 PM
Issue is compounded
This issue is compounded by the fact that passwords are a very weak form of authentication. This is why password retention and password complexity policies need to be invoked.
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14084
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell().
CVE-2018-14085
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that the owner adds the evil contract address to his sweepers. The evil contract looks like this: contract Exploit { uint public start; function swe...
CVE-2018-14086
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. The contract has an integer overflow. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell(...
CVE-2018-14087
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. The contract has an integer overflow. If the owner sets the value of buyPrice to a large number in setPrices() then the "msg.value * buyPrice" will cause an integer overflow in the fallback functio...
CVE-2018-14088
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token. The contract has an integer overflow. If the owner sets the value of amount to a large number then the "amount * 1000000000000000" will cause an integer overflow in withdrawToFounde...