This is why using email addresses as usernames is a bad idea. Credential stuffing is trivial under this scenario.
Password reuse is rampant: nearly half of observed user logins are compromised
21–30 of 51 posts
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#22Maybe if we weren't letting a third party sign arbitrary certificates for arbitrary domains they wouldn't be reading our passwords. People don't realise CloudFlare is a MitM-as-a-Service.
What do you mean? Is cloudflare causing 3rd parties to read our passwords?
Could.
A HTTP post request along the wire is unencrypted.
I'm talking about a submit button not HTTPS as that just encrypts the connection session and not the data sent from say a form.
If you're using or utilising CF for something where the data is being posted to an API unless you have client side encryption anything receiving that data will be received in plain text.
Someone only needs to compromise the service worker and syphon the data.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#23Passwords are a pain in the ass, I just wished that having a cryptographic key installed in your device (and linked to it) to login to stuff or having an external crypto-device to login was easier and more common. For local access, biometrical is fine, and a "super-secure" password for if something happens that can only be used once would be the way.
I use these a lot when available, often called "passkeys".
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#24Maybe if we weren't letting a third party sign arbitrary certificates for arbitrary domains they wouldn't be reading our passwords. People don't realise CloudFlare is a MitM-as-a-Service.
What do you mean? Is cloudflare causing 3rd parties to read our passwords?
What's more problematic is that Cloudflare is obviously reading and storing and analyzing passwords. So every service that uses Cloudflare on a login page is compromised. I bet that there are several Excel files with all scraped passwords circulating within Cloudflare.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#25Passwords are a pain in the ass, I just wished that having a cryptographic key installed in your device (and linked to it) to login to stuff or having an external crypto-device to login was easier and more common. For local access, biometrical is fine, and a "super-secure" password for if something happens that can only be used once would be the way.
Just use a KeepassXC and you are 99% there. Add some Browser extension that synchs with it and only use randomly generated passwords.
I've taken a liking to using a self-hosted Bitwarden instance via vaultwarden, and it's been a pretty good experience. The vaultwarden server is only accessible through my Tailscale network for extra security.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#26which is especially problematic I guess when random American companies are MITM the traffic and examining the unencrypted passwords?
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#27Cloud flare is an ooc spof, this will need addressing sooner or later
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#28Earlier quoted context omitted.
What do you mean? Is cloudflare causing 3rd parties to read our passwords?
What's more problematic is that Cloudflare is obviously reading and storing and analyzing passwords. So every service that uses Cloudflare on a login page is compromised. I bet that there are several Excel files with all scraped passwords circulating within Cloudflare.
That's complete nonsense. We are not storing passwords and passing around Excel spreadsheets of them!
We've worked on this stuff for years (this stuff being how to warn users about compromised passwords). You can go back to 2018 with our work with Troy Hunt on Pwned Passwords (https://blog.cloudflare.com/validating-leaked-passwords-with...), or our 2021 work on a privacy-preserving way of checking a password against a list of known compromised passwords (https://blog.cloudflare.com/privacy-preserving-compromised-c...).
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#29Passwords are a pain in the ass, I just wished that having a cryptographic key installed in your device (and linked to it) to login to stuff or having an external crypto-device to login was easier and more common. For local access, biometrical is fine, and a "super-secure" password for if something happens that can only be used once would be the way.
We could have been using SSH key logins for decades at this point but no we had to go and use usernames and passwords everywhere.
I don't want a key limited to a single device I just want a strong key that can automatically login to a website. The technology has existed for longer than the internet it just needs to become the norm.
Re: Password reuse is rampant: nearly half of observed user logins are compromised
#30Passwords are a pain in the ass, I just wished that having a cryptographic key installed in your device (and linked to it) to login to stuff or having an external crypto-device to login was easier and more common. For local access, biometrical is fine, and a "super-secure" password for if something happens that can only be used once would be the way.
Just use a KeepassXC and you are 99% there. Add some Browser extension that synchs with it and only use randomly generated passwords.
I use KeepassXC as well and it works well enough. Its still not as clean as just an SSH key login which we could have done on the web years ago and would make everyone’s life easier.