Google Has A Warning For Users Reusing Already Breached Passwords
If netizens use strong, unique passwords for all their accounts, this risk disappears.
Many people reuse breached, unsafe credentials for sensitive financial, government and e-mail accounts, putting their account at risk of hijacking by cyber criminals, according to Google.
In a recent blogpost, Google said hijackers routinely attempt to sign-in to sites across the web with credentials exposed by third-party breaches.
If netizens use strong, unique passwords for all their accounts, this risk disappears, it said.
“Based on anonymous telemetry reported by the Password Checkup extension, we found that users reused breached, unsafe credentials for some of their most sensitive financial, government, and email accounts,” it added.
Cyber attackers often have wide-scale access to billions of stolen usernames and passwords. The risk, as per Google, was even more prevalent on shopping sites (where users may save credit card details), news, and entertainment sites.
“In fact, outside the most popular web sites, users are 2.5 times more likely to reuse vulnerable passwords, putting their account at risk of hijacking,” the blog post said.
In February, Google had announced the Password Checkup extension for Chrome. This extension displays a warning when a user signs-in to a site using one of the over four billion usernames and passwords that Google knows to be unsafe due to a third-party data breach.
Google said in the first month alone, it scanned 21 million usernames and passwords, and flagged over 3.16 lakh accounts as unsafe - which was 1.5 percent of the sign-ins scanned by the extension.
The tech giant has added two new features for the Password Checkup extension.
It is adding a direct feedback mechanism where users can inform the company about any issues that they are facing via a quick comment box.
The second features is aimed at giving users more control over their data, the blog post said.
It allows users to opt-out of the anonymous telemetry that the extension reports, including the number of look-ups that surface an unsafe credential, whether an alert leads to a password change, and the domain involved for improving site coverage, the blog post said.
“By design, the Password Checkup extension ensures that Google never learns the username or password of the user, regardless of whether they enable telemetry, but we still want to provide this option if users would prefer not to share this information,” it added.