3 ms·
Oh yes it is, we have around 200k users and fighting with old leaked passwords is like a full time job. Very easy to abuse as well, the attackers can make low f
by andris9 9y ago
Oh yes it is, we have around 200k users and fighting with old leaked passwords is like a full time job. Very easy to abuse as well, the attackers can make low frequency requests from scattered IPs and thus are almost impoasible to prevent
- nerpderp83 9y agoIdentity aware proxy. User has to auth over http, then mail client can connect to IAP and ultimately to mail. And or two factor. Giving the user 10% easier usage gives the sysadmins 200% harder job. Take away the 10%.
- deleted 9y ago[deleted]
- ryanlol 9y agoI made a very specific claim which I can back up with actual data if necessary. I will make that claim even more specific: Less than 5% of the email:password combinations in the linkedin dump work today as email logins. “most” suggests a far higher success rate.
- Godel_unicode 9y agoYou added a predicate not present in the statement you replied to, "where mailprovider like LinkedIn_dump.mailprovider". Anecdotally, in authorized enterprise password audits I am frequently forced to remind people who were part of that breach that they need to change all instances of their compromised password, not just the one for the email they used in the breach. Maltego is a thing. Also, with regard to your claim to have data about which passwords work. You should be aware that accessing someone's account with their username:password without permission (even a breached password) is likely illegal in the United States under the CFAA.
- deleted 9y ago[deleted]