Passwords are inherently insecure—and continuing to use them as a primary method of authentication has led to some unfortunate consequences. As the recent Okta breach highlighted, tactics like credential stuffing remain popular among cybercriminals, and are a major cause of breaches in nearly every industry.
These attacks are relatively simple: a threat actor obtains a list of compromised credentials and uses them to attempt to log into other accounts across the internet. It’s an attack predicated on a very simple idea: remembering passwords is hard, so people tend to make them simple—and, even worse, reuse them.
Asking users to remember dozens of unique, complex passwords isn’t reasonable—and while password managers can help, relatively few people use them. Instead of fighting human nature, today’s organizations can limit their vulnerability to credential stuffing attacks by taking proactive steps to reduce their reliance on passwords entirely, embracing a more secure, passwordless future.
The evolution of credential stuffing
Attackers used to take a “spray and pray” approach to credential stuffing, banking on the idea that if they try stolen credentials in enough places, they’ll eventually hit upon a few that work. Unfortunately, now these attacks are increasingly targeted. Threat actors can even sign up for services that will notify them when credentials from potential target organizations go up for sale on the dark web. Obtaining, selling, and leveraging these credentials has effectively become its own little dark web cottage industry.
Eliminating passwords looks like the obvious answer, then—right? Well, it’s complicated. There are roadblocks that prevent many organizations from embracing an entirely passwordless approach to authentication. For example, existing passwordless options are often not compatible with all of their integrations, or they may receive pushback over the perceived hassle it creates. Fortunately, addressing the challenges that make passwords inherently insecure doesn’t demand an “all or nothing” approach. There are steps organizations can take to add additional layers of security and reduce reliance on passwords, moving toward a passwordless (or “password-lite”) authentication strategy that can significantly reduce exposure to credential stuffing and other attacks.
Three steps toward a passwordless future
By now, passwords have been declared “dead” or “obsolete” numerous times, but they remain stubbornly entrenched as the primary method of authentication for most organizations. Credential stuffing attacks, password sprays, brute-force authentications, and other methods of exploitation continue as a major threat, yet there are concrete steps organizations can take to limit their vulnerability, even if they aren’t ready to commit to fully passwordless authentication. Existing measures like MFA and physical passkeys can significantly reduce the effectiveness of credential stuffing attacks, while careful monitoring, transparent communication, and swift remediation of potential exposures let organizations cultivate a reputation for both trust and security.
Aaron Walton, threat intel analyst, Expel
