Loading…
17
TIL a stolen login can be tried against 100 sites in under an hour, and that scared me straight
I read a writeup last week from a security blog that timed credential stuffing tools, and one of them ran about 100 login attempts per minute against a list of sites. That works out to somewhere near 6,000 tries an hour per account, all automated, no human involved. What got me was that the tool didn't need anything fancy, just an email and an old password from a breach dump. I used the same password on my email, my bank, and a forum I never visit, so one leak would have opened all three. I changed the bank and email logins that same night and turned on two factor for both. If you have a password you've reused since like 2015, have you checked it against a breach site yet, and did you actually change it after?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.