New research from Google has found that "security conscious" consumers are avoiding easily guessable passwords and using unique ones for their web logins. Nevertheless, there are still hundreds of thousands of accounts out there using login credentials that have been exposed in past data breaches.
Google's findings are based on a free Chrome extension it released in February called Password Checkup, which will alert you when your password choices are weak. The extension does this by checking your logins against a database of 4 billion usernames and passwords found in past data breaches.
More than 667,000 users installed the extension in the first month after it launched. Google's security researchers then took anonymized data from the Password Checkup extension to examine the scale of vulnerable web logins.
"In the first month alone, we scanned 21 million usernames and passwords and flagged over 316,000 as unsafe," Google's security researchers wrote in a blog post on Thursday. That amounts to 1.5 percent of the sign-ins being vulnerable to "credential stuffing" attacks, in which hackers use an automated technique to plug in previously leaked passwords to break into the victim's account.
Fortunately, Google's extension was able to alert the affected users about the vulnerable passwords. But despite the warnings, the users didn't always change their logins. The company's researchers only found that 26 percent of the alerted users migrated to a new password that was generally as strong as the original password or stronger.
Other users chose to ignore the warnings from the extension, possibly because the affected account had little value, or because the users lacked full control of the account, the researchers speculated in a paper about their findings, which was written jointly with experts at Stanford University.
The 1.5 percent figure is actually lower than what a 2017 Google study found; it estimated that 6.9 percent of Google users were vulnerable to account hijacking from passwords exposed in previous data breaches. "Possible reasons [for the discrepency] include the user population that adopted our extension is more security conscious —thus avoiding reuse as a behavior," the researchers said in their paper.
The examined web logins also only covered a one-month period. As a result, it's possible users never signed into dormant or older web accounts, which are generally registered with weaker login credentials.
Google's security researchers say they'll continue refining the Password Checkup extension tool, and are considering integrating it into company products. To stay safe, it's a good idea to use a password manager, which can let you store unique, complex passwords for your different web accounts. Google offers a free one with its user accounts.