Threat profile
Password attacks
Guessing, replaying or cracking passwords: brute force, credential stuffing and password spraying.
How it works
Credential stuffing tries e-mail and password pairs leaked from one service on many others, because people reuse passwords. Password spraying tries a few very common passwords against many accounts to stay under lockout limits. Offline cracking works on a stolen database of password hashes; its speed depends on how the passwords were hashed.
What to look for
- Many failed sign-ins across different accounts from the same addresses.
- Sign-ins from new countries or devices, or at odd hours.
- Notifications about password resets you did not request.
What reduces the risk
- Use a long, unique password for every account. Length matters more than symbol rules.
- Check new passwords against lists of known breached passwords and do not force periodic changes without a reason.
- Enable multi-factor authentication and rate-limit sign-in attempts.
- Store passwords only as salted hashes made with a slow algorithm such as Argon2id, bcrypt or scrypt.
Related tool
Sources
Related threats
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).