3 ms·
tl;dr: "Credential stuffing is an attack where malicious actors use stolen username-password pairs from one service to attempt unauthorized access to other serv
by gregoriol 1y ago
tl;dr: "Credential stuffing is an attack where malicious actors use stolen username-password pairs from one service to attempt unauthorized access to other services. Unlike brute force attacks that try many passwords against one account, credential stuffing exploits the widespread problem of password reuse across multiple platforms. Defending against credential stuffing requires multiple strategies. Unfortunately no single defense provides complete protection."
- rokkamokka 1y agoI'd argue that the really old custom of providing the user a fixed username (e.g. user ID) upon registration, and requiring that for login, provides complete protection vs credential stuffing. It has other drawbacks of course, which is why you rarely see it in use anymore...
- mooreds 1y agoDo you mean a username that is distinct from email or phone number? If so, why does that provide protection against credential stuffing? A username can be reused across different applications. What am I missing?
- jaratec 1y ago> Do you mean a username that is distinct from email or phone number? No, he means a unique user id, generated by the server when you sign up for the service. Then for every login attempt, you provide the username/email + user id + password.
- mooreds 1y agoThanks. Would love to hear from other folks who have implemented this on how it affects the user experience. Seems to me it'd be high friction.
- IAmBroom 1y agoHow does providing a predictable username protect against anything at all?
- aetherson 1y agoBecause credential stuffing relies on the user reusing a username + password from another site. If you provide the user with a username they don't select, it won't be reused.
- gregoriol 1y agoBut then they have to remember the username AND the password? This doesn't help with users already having the password re-use problem. This would only work for those with a password manager, but then they are also less likely to re-use a password. Also, wouldn't this prevent lost password recovery? if you can't identify a user by their email?
- jbstack 1y ago> But then they have to remember the username AND the password? The commenter already acknowledged that the solution has drawbacks. The only claim made was that it solves credential stuffing, not that it doesn't inconvenience the user. > This would only work for those with a password manager It would also work for those without a password manager, because they'd have no choice. > Also, wouldn't this prevent lost password recovery? if you can't identify a user by their email? They're not mutually exclusive. You can have both. A compulsory unique user ID to login, and an email based password recovery mechanism.
- deleted 1y ago[deleted]
- aetherson 1y agoYes, there are clear ergonomic reasons why we don't do this "assign a username" thing. But it would stop password stuffing. You'd presumably do username recovery the same way you do password recovery, so it would only be accessible to an attacker who compromised the user's email.
- jbstack 1y ago"Unfortunately no single defense provides complete protection" For the server, maybe. For the user, a password manager (used properly) is a solid single defense solution.
- IAmBroom 1y agoI first noticed this weakness when I was caught in a "password breach", which was really a fishing site for passwords. I checked the list of passwords, and a significant amount had values like "uRFcWEBSITENAME". I reasoned first they would try USERNAME, PASSWORD, and then try USERNAME with passwords updated for the other websites they were hacking. Even the section of passwords beginning with just the first letter of WEBSITENAME was unusually large. Then I scanned for passwords containing the first few letters of WEBSITENAME... yup, a conspicuous lot of them. Those people at least tried to be smart about their password uniqueness, but it didn't really work.
- fhdkweig 1y agoI've heard of users using a similar trick on email addresses for the purpose of finding out which site leaked their information in the future. At least now you know which sites have bad security with passwords.