Free Password Checkup extension for Chrome

It automatically takes the encrypted login credentials that we enter and verifies if they may have been compromised by cross-checking from a central database.

The tool developed with the help of Stanford cryptography researchers is available through a Password checkup extension on Chrome Web Store and notifies users whenever it finds that the user has entered username or password that has been leaked before in a data breach.

https://www.hackread.com/dodging-bad-passwords-with-googles-new-tool/

2FA is a MUST but combining 2FA with Awareness training is the way-to-go - Hackers have been refining their password-stealing schemes to also nab the one-time passcode. So-called "phishing kits" steal a victim's password and two-factor authentication passcode as they type it into deceptive email and login pages, and then quickly break into the affected account within the 30-SECOND time limit.

OR
Use hardware-based solution like USB security keys (which introduce a different problem, support and maintenance)

https://in.pcmag.com/google-titan-security-key-bundle/129100/google-phishing-attacks-that-can-beat-two-factor-are-on-the

Identity theft protection firm LifeLock may have exposed user email addresses - How?

 An IT security researcher noted that unsubscribing from LifeLock’s newsletter revealed subscriber’s key.Upon further digging the researcher found out that key number is sequential and with the help of script written by himself he could extract keys and corresponding email addresses of every LifeLock subscribers

This is not the first time that LifeLock has done such a blunder. In 2014, the company pulled its Wallet app from availability and deleted all user data after it was revealed that the app may not be following standard security protocol.

Last year, a vulnerability in LastPass password manager allowed hackers to steal its customers’ login credentials. Moreover, in June 2017, OneLogin password manager suffered a cyber attack in which personal data of millions of users was stolen.



https://www.hackread.com/identity-theft-protection-firm-lifelock-exposed-user-emails/

Exploiting an 11-year-old bug in browsers' built-in password managers

Third-party tracking scripts found by researchers on these websites inject invisible login forms in the background of the webpage, tricking browser-based password managers into auto-filling the form using the saved user's information.


For More:
https://thehackernews.com/2018/01/browser-password-managers.html

What is the market for stolen passwords?

Just the first seven months of 2017, a botmaster sold approximately 35,000 credential pairs earning him more than $288,000 and almost 9,000 different customers chose to purchase one or more of his username and password pairs.


For More:
https://krebsonsecurity.com/2017/12/the-market-for-stolen-account-credentials/

Have you enabled MFA for your account? - Because, someone found 1.4 billion usernames and passwords in clear text

The collective database contains plain text credentials leaked from Bitcoin, Pastebin, LinkedIn, MySpace, Netflix, YouPorn, Last.FM, Zoosk, Badoo, RedBox, games like Minecraft and Runescape, and credential lists like Anti Public, Exploit.in.


"None of the passwords are encrypted, and what's scary is that we've tested a subset of these passwords and most of the have been verified to be true," Casal said


For More:
https://thehackernews.com/2017/12/data-breach-password-list.html

Another reason to use MFA (Multi Factor Authentication) -77% of the FTSE 100 were exposed

If they had enabled Multi Factor Authentication (MFA) then , the RISK associated could have been low/Minimal

77% of the FTSE 100 were exposed with an average of 218 usernames and password stolen, published or sold per company.

A significant number of credentials linked to FTSE 100 organisations were still left compromised over the three months following the discovery.


For More:
https://blog.knowbe4.com/77-of-the-ftse-100-have-compromised-credentials-what-is-your-stolen-password-percentage

If you are using ZyXEL device and haven't changed the default password , your device might be compromised

An uptick in botnet activity associated with a variant of Mirai. Targeted are ports 23 and 2323 on internet-connected devices made by ZyXEL Communications that are using default credentials.

In October 2016, Mirai malware spread itself to IoT devices gaining access via default password and usernames. The malware then roped affected devices into a botnet and carried out distributed denial of service (DDoS) attacks


For More:
https://threatpost.com/newly-published-exploit-code-used-to-spread-marai-variant/128998/

Very Interesting conversation/debate on PASSWORDS - Highly recommended

Check Here:


https://www.schneier.com/blog/archives/2017/10/changes_in_pass.html

LastPass users - you may want to read this

When people have the LastPass binary running, the vulnerability allows malicious websites to execute code of their choice. Even when the binary isn't present, the flaw can be exploited in a way that lets malicious sites steal passwords from the protected LastPass vault.

"It will take a long time to fix this properly, It's a major architectural problem"



For More information:
https://arstechnica.com/security/2017/03/potent-lastpass-exploit-underscores-the-dark-side-of-password-managers/

Simple and easy - Password protection suggestion

Security folks know this.
For ordinary folks , this might help.


http://www.cnbc.com/2016/02/24/8-ways-to-protect-your-passwords-from-identity-theft-online.html

Password Issues - In a single picture

Complex Passwords - Are not really safe anymore

I am more or less 100% in agreement with the author.

Summary

pinning your security on an insanely complex password is a fool’s wager. 

From the Article

According to Alex Holden, Hold Security’s founder, the “vast majority” of the passwords he uncovered had been stored in plain text on company servers.

says Donna Dodson NIST’s chief cyber security advisor. “Putting the burden of security on the end-user and making it more complex just doesn’t work,” she says. “The security has to be usable for the end-user. Otherwise they’re going to find workarounds.”

The cracking software that’s out there has known about all of these tricks for more than a decade,” says Herley. 

What’s more, system administrators need to spend more time securing the passwords they store. If sysadmins had been taking care of business before the Russian hack—locking down their websites and protecting their users passwords with cryptography instead of storing them in plain text—users would be a lot better off. 

Follow this link for additional details:

http://www.wired.com/2014/08/passwords_microsoft/

Re-use your passwords - Says Microsoft.

Not exactly, suggestion is to re-use for low risk sites;

Still, I don't agree fully.

(From the article)

Now Redmond researchers Dinei Florencio and Cormac Herley, together with Paul C. van Oorschot of Carleton University, Canada, have shot holes through the security dogma in a paper Password portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts (PDF).

The trio argue that password reuse on low risk websites is necessary in order for users to be able to remember unique and high entropy codes chosen for important sites.

The link below has more information:-

http://www.darknet.org.uk/2014/07/microsoft-says-re-use-passwords-across-sites/

Implementing Forgot Password with Email

Nothing great, it just outlines all the necessary steps in one place.



The link below has more information:-
http://appsecnotes.blogspot.com/2014/04/implementing-forgot-password-without.html