3 ms·

See page 5 of the Verizon report and the number is 81%: https://www.verizon.com/business/resources/reports/2017_dbir.pdf https://www.verizon.com/business/resou

• mooreds 5y ago
  Awesome, thanks for sharing that link from 2017. For everyone not going to go to the PDF, the text is "81% of hacking-related breaches leveraged either stolen and/or weak passwords." So I'm not sure that you can say that all data breaches are related to static passwords, but it sure a big number and a problem. I looked at the 2020 Verizon report, but unfortunately they changed their methodology or reporting so I didn't see a figure for that year for "hacking-related breaches".
  • djbusby 5y ago
    > not sure that you can say that all data breaches are related to static passwords Nobody said that.
    • mooreds 5y ago
      Sorry, you are absolutely correct. I mistyped. The original post ( https://news.ycombinator.com/item?id=29306921 https://news.ycombinator.com/item?id=29306921 ) said "Over 80% of data breaches are through static passwords." What I should have said was "So I'm not sure that you can say that ~80% of data breaches are related to static passwords, but it sure a big number and a problem" because: * hacking-related breaches != data breaches and * stolen and/or weak passwords != static passwords But the bigger point stands: passwords are a problem.
      • fragmede 5y ago
        weak passwords can be mitigated against, and password reuse limits (of one - no password reuse, ever) the attack surface from there, along with using HIBP's breach database. NIST updated their recommendations about passwords, and forcing a change of password every 30 days was removed because it caused other, more leaky behavior in practice.