{"id":3758,"date":"2014-07-18T23:25:53","date_gmt":"2014-07-18T15:25:53","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3758"},"modified":"2015-09-09T19:36:48","modified_gmt":"2015-09-09T11:36:48","slug":"microsoft-says-re-use-passwords-across-sites","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2014\/07\/microsoft-says-re-use-passwords-across-sites\/","title":{"rendered":"Microsoft Says You SHOULD Re-use Passwords Across Sites"},"content":{"rendered":"

Ok so we constantly tell people not to reuse passwords across sites, because if they are stored in plain text (and leaked<\/a>) those naughty hackers now have your e-mail address AND your password and can wreak havoc on your life.<\/p>\n

Which is pretty much true, but Microsoft disagrees and there is some validity to what they say, if you MUST re-use passwords (which you shouldn’t) – do so only on low risk sites (anything without payment details really).<\/p>\n

\"Re-use<\/p>\n

Keep the good passwords for the important sites (like online banking).<\/p>\n

As for me, I say use a bloody password manager, generate different passwords for every site and make them all strong! A good online password manager is free, and even though some of them appear to not be totally secure (as we wrote a few days ago<\/a>) – they are certainly better than not using one.<\/p>\n

Microsoft has rammed a research rod into the security spokes of the internet by advocating for password reuse in a paper that thoroughly derails the credentials best practise wagon.<\/p>\n

Password reuse has become a pariah in internet security circles in recent years following a barrage of breaches that prompted pleas from hacked businesses and media outlets to stop repeating access codes across web sites.<\/p>\n

The recommendations appeared logical; hackers with email addresses and passwords in hand could test those credentials against other websites to gain easy illegal access.<\/p>\n

Now Redmond researchers Dinei Florencio and Cormac Herley, together with Paul C. van Oorschot of Carleton University, Canada, have shot holes through the security dogma in a paper Password portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts (PDF).<\/p>\n

The trio argue that password reuse on low risk websites is necessary in order for users to be able to remember unique and high entropy codes chosen for important sites.<\/p><\/blockquote>\n