{"id":86062,"date":"2018-10-30T08:42:51","date_gmt":"2018-10-30T15:42:51","guid":{"rendered":"https:\/\/www.backblaze.com\/blog\/?p=86062"},"modified":"2021-08-09T10:45:46","modified_gmt":"2021-08-09T17:45:46","slug":"how-to-protect-yourself-from-credential-stuffing-attacks","status":"publish","type":"post","link":"https:\/\/www.backblaze.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/","title":{"rendered":"Credential Stuffing Attacks: What They Are and How to Protect Yourself"},"content":{"rendered":"

\"a<\/a>
\nWhile we often see warnings about password best practices<\/em> (different passwords for different services, change passwords frequently, 123456<\/em> is never a good password), we rarely get into why we need to do these things. Incremental security comes at a cost: usually convenience. Every individual must decide her personal tradeoffs. Today, we want to share one of the ways malicious actors try to take advantage of online services and poorly-crafted passwords: credential stuffing attacks.<\/p>\n

What is a Credential Stuffing Attack?<\/h2>\n

A credential stuffing attack occurs when an attacker takes a set of stolen user credentials and automates the entry of those credentials into popular websites. Let\u2019s unpack that:<\/p>\n

\n
Credentials<\/dt>\n
A user name and password combination used for logging in to service x.<\/dd>\n
Breached credentials<\/dt>\n
A list of user name\/password combinations that have become public in some form. As an example, an enterprising cybercriminal exploits credentials from Adobe, Coachella, Dropbox, LinkedIn, Ticketfly, Yahoo and other sites that have leaked personal information for over 500 million accounts<\/a>.<\/dd>\n
Automated entry<\/dt>\n
The cybercriminal will go to the login page on service x and systematically cycle through each user name and password combination hoping to get lucky enough to find a match. Some will even go further by using one email address and cycling through all the passwords in the database — the logic being that users tend to come up with similar passwords, such as 123456 or Pa$$word$.<\/dd>\n<\/dl>\n

What is Backblaze Doing to Defend Against Credential Stuffing Attacks?<\/h3>\n

Every service of scale, including Backblaze, has defense mechanisms to inhibit this sort of activity. For instance, when you see “too many attempts, try again later,” on a popular site, what is likely happening behind the scenes is something called rate limiting<\/em>. This is when a web page has a rule akin to: if there are x number of login attempts in y seconds, it\u2019s probably a robot; we should cut them off.<\/p>\n

The problem is balancing security with the user experience. If we limited every account to two login attempts per hour, that would hamstring the efforts of any automated attack. However, it would also impede the efforts of legitimate users who made a simple typo when they were entering their password.<\/p>\n

Revealing our exact rate limiting policies would pose a security risk to our users, allowing the attackers to fine-tune an attack. That said, we do have rate limiting, we do constantly monitor our systems, and we also have algorithms and humans that will adjust our rate limiting depending on a number of environmental variables that our security team monitors.<\/p>\n

The Three Steps We Tell Everyone In Our Family to Take<\/h3>\n

With the large number of data breaches over the past few years, it\u2019s more likely than not that you\u2019ve been exposed. If you\u2019ve been using the same email and password combination for three years and have a Comcast account that old, you could be exposed<\/a>. It’s the same story for Ticketfly accounts older than May of 2018. We mention these not to single out any particular service, but to point out how prevalent these things are.<\/p>\n

However, if you have different passwords for every website, you effectively protect yourself from being hacked as a result of leaks like these. While that might be true, trying to remember and manage all those different combinations is cumbersome.<\/p>\n

How to Fight Back Against Credential Stuffing<\/h2>\n

Protecting yourself from credential stuffing attacks can be as simple as adopting the following three tactics:<\/p>\n

1 — Monitor Your Email Addresses<\/h3>\n

Troy Hunt runs a phenomenal service called haveibeenpwned.com<\/a>. He tracks major breaches and will let you know if your credentials were included in them. It\u2019s free, although you can donate to the service<\/a>. Signing up is one of the easiest ways to take control of your own security.<\/p>\n

2 — Use Two Factor Verification<\/h3>\n

2FV, as it\u2019s commonly called, is when you are asked for an incremental authentication — usually numbers generated by a dedicated app (including a password manager) — after you enter your password. Backblaze offers it as a complimentary service<\/a> as do many other service providers. 2FV is a good defense mechanism against credential stuffing.<\/p>\n

3 — Use a Password Manager<\/h3>\n

We highly recommend using a password manager such as Bitwarden<\/a>, LastPass<\/a>, or 1Password<\/a>. Those services can help create new account credentials for every website you frequent, and help you manage those credentials when you visit those sites. Many people at Backblaze use these services and are quite happy with them.<\/p>\n

One of the advantages of password managers is that they let you create passwords you can\u2019t possibly remember. You just need to remember the master password to your password manager; they do the rest. That means you can set complicated passwords to any service. Each of the password managers integrate well into all major browsers and into Android and iOS devices. Not only will a password manager make your life secure, it makes your login experience much faster.<\/p>\n

The Best Protection Against Credential Stuffing Is\u2026<\/h2>\n

Of course, the best protection in the world is never being exposed in the first place. We encourage everyone to do business with vendors that can articulate how they protect their customers and have a sustained investment in doing so. At Backblaze, we\u2019ve outlined our approach to security on our website<\/a>.<\/p>\n

All that said, the reality is we\u2019ve all created accounts with service providers that may not have the best security practices. Even still, any website with the best intentions can still be felled by a skilled attacker, which is why the the need to protect ourselves and use credential best practices is very real. We hope, and strongly recommend, that everyone follow the three steps mentioned here.<\/p>\n

If you have other other tips for the community, please feel free to share in the comments below!<\/p>\n","protected":false},"excerpt":{"rendered":"

Over 500 million login credentials have been exposed due to breaches of high-traffic websites including Adobe, Coachella, Dropbox, LinkedIn, Ticketfly, and Yahoo. We present three simple tactics you can use to protect yourself from hackers exploiting these breaches in credential stuffing attacks.<\/p>\n","protected":false},"author":131,"featured_media":86078,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":"","jetpack_post_was_ever_published":false,"_ppma_block_editor_authors":""},"categories":[121],"tags":[471,384],"ppma_author":[531],"class_list":["post-86062","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-backing-up","tag-businessbackup","tag-security","entry"],"acf":[],"yoast_head":"\n3 Tips for Avoiding Getting Caught in a Credential Stuffing Attack<\/title>\n<meta name=\"description\" content=\"A credential stuffing attack occurs when an attacker takes a set of stolen user credentials and automates the entry of those credentials into popular websites.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.backblaze.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"3 Tips for Avoiding Getting Caught in a Credential Stuffing Attack\" \/>\n<meta property=\"og:description\" content=\"A credential stuffing attack occurs when an attacker takes a set of stolen user credentials and automates the entry of those credentials into popular websites.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/\" \/>\n<meta property=\"og:site_name\" content=\"Backblaze Blog | Cloud Storage & Cloud Backup\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/backblaze\" \/>\n<meta property=\"article:published_time\" content=\"2018-10-30T15:42:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-09T17:45:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2018\/10\/login-credential-stuffing.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1440\" \/>\n\t<meta property=\"og:image:height\" content=\"820\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ahin Thomas\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@backblaze\" \/>\n<meta name=\"twitter:site\" content=\"@backblaze\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ahin Thomas\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"3 Tips for Avoiding Getting Caught in a Credential Stuffing Attack","description":"A credential stuffing attack occurs when an attacker takes a set of stolen user credentials and automates the entry of those credentials into popular websites.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.backblaze.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/","og_locale":"en_US","og_type":"article","og_title":"3 Tips for Avoiding Getting Caught in a Credential Stuffing Attack","og_description":"A credential stuffing attack occurs when an attacker takes a set of stolen user credentials and automates the entry of those credentials into popular websites.","og_url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/","og_site_name":"Backblaze Blog | Cloud Storage & Cloud Backup","article_publisher":"https:\/\/www.facebook.com\/backblaze","article_published_time":"2018-10-30T15:42:51+00:00","article_modified_time":"2021-08-09T17:45:46+00:00","og_image":[{"width":1440,"height":820,"url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2018\/10\/login-credential-stuffing.jpg","type":"image\/jpeg"}],"author":"Ahin Thomas","twitter_card":"summary_large_image","twitter_creator":"@backblaze","twitter_site":"@backblaze","twitter_misc":{"Written by":"Ahin Thomas","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/#article","isPartOf":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/"},"author":{"name":"Ahin Thomas","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/person\/d96439e8602526b2212669b824c41c49"},"headline":"Credential Stuffing Attacks: What They Are and How to Protect Yourself","datePublished":"2018-10-30T15:42:51+00:00","dateModified":"2021-08-09T17:45:46+00:00","mainEntityOfPage":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/"},"wordCount":983,"commentCount":4,"publisher":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization"},"image":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2018\/10\/login-credential-stuffing.jpg","keywords":["BusinessBackup","Security"],"articleSection":["Backing Up"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/","name":"3 Tips for Avoiding Getting Caught in a Credential Stuffing Attack","isPartOf":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/#primaryimage"},"image":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2018\/10\/login-credential-stuffing.jpg","datePublished":"2018-10-30T15:42:51+00:00","dateModified":"2021-08-09T17:45:46+00:00","description":"A credential stuffing attack occurs when an attacker takes a set of stolen user credentials and automates the entry of those credentials into popular websites.","breadcrumb":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/#primaryimage","url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2018\/10\/login-credential-stuffing.jpg","contentUrl":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2018\/10\/login-credential-stuffing.jpg","width":1440,"height":820},{"@type":"BreadcrumbList","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/how-to-protect-yourself-from-credential-stuffing-attacks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Credential Stuffing Attacks: What They Are and How to Protect Yourself"}]},{"@type":"WebSite","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#website","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/","name":"Backblaze Cloud Solutions Blog","description":"Cloud Storage & Cloud Backup","publisher":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#organization","name":"Backblaze","url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.backblaze.com\/blog\/wp-content\/uploads\/2017\/12\/backblaze_icon_transparent.png?fit=512%2C512&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.backblaze.com\/blog\/wp-content\/uploads\/2017\/12\/backblaze_icon_transparent.png?fit=512%2C512&ssl=1","width":512,"height":512,"caption":"Backblaze"},"image":{"@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/backblaze","https:\/\/x.com\/backblaze","https:\/\/www.youtube.com\/user\/Backblaze","https:\/\/en.wikipedia.org\/wiki\/Backblaze"]},{"@type":"Person","@id":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/#\/schema\/person\/d96439e8602526b2212669b824c41c49","name":"Ahin Thomas","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fd29930968c75c628d357b38fd5439de48f41a51a2ce641021e242cafbb946d?s=96&d=blank&r=ge10fe639397e3ce169a92674c8c2ba57","url":"https:\/\/secure.gravatar.com\/avatar\/1fd29930968c75c628d357b38fd5439de48f41a51a2ce641021e242cafbb946d?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fd29930968c75c628d357b38fd5439de48f41a51a2ce641021e242cafbb946d?s=96&d=blank&r=g","caption":"Ahin Thomas"},"description":"Ahin enjoys writing in the third person, cookies (digital or baked), and is listening to the Matt Nathanson \"Live in Paradise\" album.","sameAs":["https:\/\/www.backblaze.com","Ahin"],"url":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/author\/ahin\/"}]}},"authors":[{"term_id":531,"user_id":131,"is_guest":0,"slug":"ahin","display_name":"Ahin Thomas","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/1fd29930968c75c628d357b38fd5439de48f41a51a2ce641021e242cafbb946d?s=96&d=blank&r=g","author_category":"","first_name":"Ahin","last_name":"Thomas","user_url":"https:\/\/www.backblaze.com","job_title":"","description":"Ahin enjoys writing in the third person, cookies (digital or baked), and is listening to the Matt Nathanson \"Live in Paradise\" album."}],"jetpack_featured_media_url":"https:\/\/backblazeprod.wpenginepowered.com\/wp-content\/uploads\/2018\/10\/login-credential-stuffing.jpg","_links":{"self":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts\/86062","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/users\/131"}],"replies":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/comments?post=86062"}],"version-history":[{"count":0,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/posts\/86062\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/media\/86078"}],"wp:attachment":[{"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/media?parent=86062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/categories?post=86062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/tags?post=86062"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/backblazeprod.wpenginepowered.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=86062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}