News Researchers Learn How Web Services Regulate User Passwords

[НСК-СБ]

Researchers Learn How Web Services Regulate User Passwords

Maria Nefyodova
Digital Security experts tested the password policies of 157 web services, including social networks, email clients, cloud storage and Internet banking. The experts found out which sites have the most stringent rules for creating passwords and are thus potentially safe; what recommendations for protecting accounts are given to users and when using which sites the user is likely to become a victim of an attacker.

Researchers made the following requirements for the passwords studied:

• Password must be longer than 8 characters;
• the password must contain numbers, upper and lower case letters;
• password should not be like login.

In addition, it was taken into account that services should give general recommendations on password complexity to users and not allow registration with any of the tested combinations of characters. To test the ability to set simple passwords, passwords were selected from several well-known dictionaries, including Rockyou and Top 10,000 worst passwords.

As a result, the following groups of services were tested: mail services, social networks, electronic commerce, payment services, game services, cryptocurrency, data storage, joint development, hosting, password managers, news services, entertainment resources, blogs and forums, Internet banking.

Based on the test results, services were awarded points based on which a rating was compiled: a maximum of 11.5 points. So, it turned out that gaming services over time (a comparison was made with a similar study in 2015) began to take better care of password policies, unlike payment systems. And social networks practically do not control the creation of passwords by users, which as a result leads to an increased risk of hacking. For example, Facebook earned 8 points out of a possible 11.5 and took first place among the tested social networks, in second - StackExchange, in third place - "Classmates", in fourth - Tinder, fifth in Instagram, sixth in Twitter, and only in seventh place Vkontakte is located.

We also checked the mail services. They turned out to be leaders in the security of password policies. Their rating looks like this: Outlook - 10 points, Gmail - 9 points, Mail and Yahoo - 7.5 points, Yandex - 6 points, Rambler - 1.5 points.

The winner of the previous rating of payment services, WebMoney, this time earned -0.5 and moved to last place, and Skrill took the first place.



Researchers emphasize that foreign services pay more attention to password settings than Russian ones. In cases where the sites do not provide any recommendations for creating passwords, the responsibility for this lies entirely with the user. If the user registers a weak password, then the likelihood of a hacker attack on his account increases significantly.

“In the testing of services, various indicators were taken into account for the requirement of passwords from web services: the length of the password and its content, does the site offer recommendations for creating a password, what rules should the user follow when choosing character combinations, is it possible to register on the site with a weak or dictionary password, are there any mechanisms from unauthorized authorization, is it possible that the login and mail match, what restrictions do the services use when registering or recovering the password, ”said study co-author Ivan Yushkevich, an analyst at Digital Security.

Detailed results and testing methodology are presented in the Digital Security report “ Testing Web Services Password Policies 2.0 ".



Researchers Learned How Web Services Regulate User Passwords - Hacker