In early 2019, white-hat security expert Troy Hunt and other researchers shared a massive database of breached passwords and usernames. The stolen data constitutes 25 billion records and 845 gigabytes of stolen data.
While many of the collected records are from previously reported thefts, there are new records there, too. It’s a clear indication of regularity, scope and potential damage caused by poor password management.
That news coincided with Google’s announcement of its new Password Checkup extension for Chrome browsers. The extension is designed to alert and protect users who may have compromised credentials.
What is the Password Checkup Extension?
Password Checkup allows users to check if their Google account, and any other account you check into while using Chrome, has been potentially compromised during a previous data breach. Developed in partnership with Stanford University cryptographers, the extension is designed to give you critical information while safeguarding your data.
How Does Password Checkup Work?
After installing the extension, Google will alert users if they find potentially compromised passwords. The passwords are checked against a database of 4 billion known compromised credentials. Warnings are issued automatically, along with a recommendation to change the potentially compromised credential.
It’s important to note that the extension will not alert you to any outdated passwords or weak passwords. While those other factors can also lead to your account information being hacked, the Password Checkup only identifies known hacked passwords contained in databases.
What Does It Look Like When Password Checkup Is Activated?
The Password Checkup icon appears in your browser bar as a green security shield. The extension app will monitor your account whenever you use Chrome to log into a website or a service.
If it detects that the password is potentially compromised, a bright red warning box pops onto your screen. It features a warning sign and urges you to change your password. The box allows you to ignore the alert for the designated site. There’s also a link to learn more information via a page with more details about Password Checkup and how to change a potentially compromised password.
If for some reason you miss the red pop-up box, the browser extension icon turns from green to red.
Can Google See My Passwords if I use Password Checkup?
No. None of the passwords that the app uses are stored and personal information is not collected. The checked passwords are anonymized using hashes and encryption. Password Checkup was designed to prevent hackers from attacking it.
What Are the Risks of Compromised Passwords?
News stories are constantly reporting on the latest corporate data breach, revealing the thousands of records that were exposed and how that company is responding. The story behind the story is what happens to those stolen credentials.
In some cases, hackers sell information on the dark web. For users that do not know about the hack or aware but choose to do nothing, the consequences can be dire. Bad actors now can access accounts, make purchases, steal money or gain other personal information that can help to steal one’s identity.
People affected by stolen credentials can spend months or years resolving the issues related to compromised accounts. This work is time-consuming, costly and stressful.
Are There Other Tools to Check Compromised Credentials?
How Prevalent Are Data Breaches?
According to the 2019 Verizon Data Breach Investigations Report, stolen credentials are also an increasingly popular approach for hackers looking to gain access to cloud-based email servers. Stolen credentials are a particular issue for businesses in the accommodations and food services, financial and insurance, educational services, manufacturing and professional services industries.
What Can Be Done to Prevent Compromised Credentials?
For businesses, there are several steps that can mitigate the risks of data breaches that result in compromised credentials:
- Develop and enforce rigorous password policies, including password complexity, reuse and expiration dates
- Implement two-factor or multi-factor authentication that uses both known information, such as a stored password, and new information, such as a texted or emailed credential, (e.g. a one-time access code)
- Centralized identity access management
- Centrally managed single sign-on protocols
Google’s new extension is an excellent way to provide individual Chrome users with information that will protect themselves and their personal information. When combined with broader business rules, the extension should reduce the rate and severity of compromised credentials.
Katika mwaka wa 2019, mtaalamu wa usalama wa kofia nyeupe Troy Hunt na watafiti wengine walishiriki hifadhidata kubwa ya nywila na majina ya watumiaji yaliyovunjwa. Takwimu zilizokuwa zimeibiwa ni bilioni 25 na gigabytes 845 za data. Ingawa rekodi nyingi zilizokusanywa ni kutoka wizi ulioripotiwa hapo awali, kuna rekodi mpya huko pia. Ni dalili ya wazi ya utaratibu, wigo na uharibifu wa uwezekano unasababishwa na usimamizi duni wa nenosiri. Habari hiyo ilipatana na tangazo la Google la ugani wake mpya wa Uchunguzi wa Nenosiri kwa vivinjari vya Chrome. Upanuzi ni iliyoundwa kuonya na kulinda watumiaji ambao wanaweza kuwa na dhamana kuathiriwa. Ni nini kiendelezi cha ukaguzi wa nenosiri? "Kichwa cha habari cha ""Password Checkup"" kinaruhusu watumiaji kuangalia ikiwa akaunti yao ya Google, na akaunti nyingine yoyote unayoangalia wakati wa kutumia Chrome, imeharibiwa wakati wa uvunjaji wa data wa awali." Iliundwa kwa kushirikiana na Stanford Chuo Kikuu cryptographers, ugani ni iliyoundwa kukupa habari muhimu wakati kulinda data yako. Jinsi Uchunguzi wa Nenosiri Unavyofanya Kazi Baada ya kufunga ugani, Google itawaonya watumiaji ikiwa watapata nywila zinazoweza kuathiriwa. Nambari za siri zinakabiliwa na hifadhidata ya takwimu za kuaminika za bilioni 4 zinazojulikana. Maonyo hutolewa moja kwa moja, pamoja na pendekezo la kubadilisha sifa zinazoweza kuathiriwa. Ni muhimu kutambua kwamba ugani si kuonya wewe kwa yoyote password outdated au password dhaifu. Ingawa mambo mengine yanaweza pia kusababisha habari ya akaunti yako kutekwa, ukaguzi wa nenosiri hutambua tu nywila zilizovunjwa zinazojulikana zilizo katika hifadhidata. Ni nini Inaonekana Kama Wakati Password Checkup Ni Activated? Ikonu ya ukaguzi wa nenosiri inaonekana katika bar ya kivinjari chako kama ngao ya usalama ya kijani. Programu ya upanuzi itasimamia akaunti yako wakati wowote unapotumia Chrome kuingia kwenye wavuti au huduma. Ikiwa inagundua kwamba nenosiri linaweza kuathiriwa, sanduku la onyo nyekundu kali huonekana kwenye skrini yako. Ina ishara ya onyo na inakuomba ubadilishe nenosiri lako. Sanduku inaruhusu wewe kupuuza onyo kwa ajili ya tovuti maalum. Pia kuna kiungo cha kujifunza habari zaidi kupitia ukurasa na maelezo zaidi kuhusu ukaguzi wa nenosiri na jinsi ya kubadilisha nenosiri ambalo linaweza kuathiriwa. Kama kwa sababu fulani miss pop-up sanduku nyekundu, icon browser upanuzi inageuka kutoka kijani kwa nyekundu. Je, Google inaweza kuona nywila zangu ikiwa ninatumia Uchunguzi wa Nenosiri? La, sivyo. Hakuna moja ya nywila kwamba programu hutumia ni kuhifadhiwa na habari ya kibinafsi si kukusanywa. Maneno ya siri yaliyochunguzwa hayatajulikana kwa kutumia hashes na encryption. Password Checkup ilitengenezwa ili kuzuia wahasibu kuishambulia. Ni Hatari Zipi Zinavyoweza Kutokana na Maneno ya siri Yenye Uharibifu? Habari za habari zinaripoti mara kwa mara juu ya uvunjaji wa data ya kampuni ya hivi karibuni, ikifunua maelfu ya rekodi zilizofichuliwa na jinsi kampuni hiyo inavyokabiliana. Kumbuka kwamba hadithi ya nyuma ya hadithi ni nini kinachotokea kwa sifa hizo zilizoibiwa. Katika visa fulani, wahasibu huuza habari kwenye mtandao wa giza. Kwa watumiaji ambao hawajui kuhusu hack au wanajua lakini kuchagua kufanya chochote, matokeo yanaweza kuwa mbaya. Watendaji wabaya sasa wanaweza kupata akaunti, kufanya ununuzi, kuiba pesa au kupata habari nyingine za kibinafsi ambazo zinaweza kusaidia kuiba utambulisho wa mtu. Watu walioathiriwa na sifa zilizoibiwa wanaweza kutumia miezi au miaka kutatua masuala yanayohusiana na akaunti zilizoharibiwa. Kazi hiyo huchukua wakati mwingi, inagharimu pesa nyingi, na huchosha. Je, Kuna Vifaa Nyingine vya Kuchunguza Vyeti Vilivyoathiriwa? Uvunjaji wa Takwimu Ni wa Kiasi Gani? Kulingana na Ripoti ya Uchunguzi wa Uvunjaji wa Takwimu ya Verizon ya 2019, uthibitisho uliibiwa pia ni mbinu inayopendwa zaidi na wahasibu wanaotafuta kupata huduma za barua pepe za wingu. Uhakika uliibiwa ni suala maalum kwa biashara katika huduma za malazi na chakula, huduma za kifedha na bima, huduma za elimu, utengenezaji na sekta za huduma za kitaaluma. Ni Nini Kinachoweza Kufanywa Ili Kuzuia Utambulisho Usiwe na Uaminifu? Kwa biashara, kuna hatua kadhaa ambazo zinaweza kupunguza hatari za uvunjaji wa data ambao husababisha sifa za kuathiriwa: - Kuendeleza na kutekeleza sera kali za nenosiri, pamoja na utata wa nenosiri, matumizi ya mara kwa mara na tarehe za kumalizika - Kutekeleza uthibitisho wa sababu mbili au nyingi ambazo hutumia habari inayojulikana, kama vile nenosiri lililohifadhiwa, na habari mpya, kama vile hati ya uthibitisho wa maandishi au barua pepe. "Kupitia ""Usimamizi wa Ufikiaji wa Utambulisho wa Kati"" (CIDM), Google inaongeza kuwa ni njia bora ya kutoa watumiaji wa Chrome habari ambayo itawalinda wao na habari zao za kibinafsi." Wakati pamoja na sheria pana ya biashara, upanuzi inapaswa kupunguza kiwango na ukali wa sifa compromised.