Deutsch
EnglishVerify Login Credentials to Protect against Credential-Stuffing Attacks
- Reading time:
- 8 min
Users to Verify Their Login Credentials to Protect against Credential-Stuffing Attacks
Checking credentials against leaked login information is an important safeguard to protect against credential stuffing attacks, as it helps prevent the use of stolen credentials.
When users check their credentials on a platform that matches whether the data has been leaked in the past, they can determine whether their credentials may have already fallen into the hands of attackers. If so, they should change their password as soon as possible and, if necessary, consider other security measures such as enabling two-factor authentication.
However, this presents the following challenges for an ordinary user:
User challenges when checking login data leakage
- Awareness: The user of online platforms must have the appropriate awareness and understanding of the dangers posed by credential stuffing attacks.
- Knowledge: The user has to know about an appropriate service for checking his login data against credentials that have been leaked.
- Quality: When choosing a possible service for verification, the user must be able to ensure that the service itself is secure and provides a sufficiently large and up-to-date database.
- Sufficient: The selected service must provide sufficient information about the login data to provide the user with a valid basis for decision-making. For example, the fact that the e-mail address is part of a leak data collection is not sufficient information, since the user learns nothing about the threat to his login data (e-mail address and password).
- Risk Assessment: Users must be able to distinguish fraudulent services from trustworthy services in order to avoid becoming a victim of a phishing attack by a fraudulent website.
- Regularly: It is necessary to perform an appropriate check on a regular basis to ensure adequate protection.
- Exhaustive: The user must remember and specifically check all online accounts and the login information chosen there, in order to adequately protect his entire online presence.
- Follow-up: In the event of a hit on the user’s login information, the user must be able to take appropriate action, such as a password change, on all affected services.
Overall, regularly checking credentials for leaked login information is an effective protective measure against credential-stuffing attacks. However, a typical user will hardly be able to master the challenges mentioned above in order to fully check all his logins at the necessary regular intervals.
Online Platform Operators to Verify User’s Login Credentials to Protect against Credential-Stuffing Attacks
Operators have the technical ability to effectively protect the users of their platform against account takeover attacks as a result of credential stuffing. In addition, the operator has the task (or duty) of ensuring an appropriate level of security and thus meeting regulatory requirements, preserving its reputation and, last but not least, safeguarding its corporate foundation. Various IT security guidelines, such as the BSI Grundschutz (BSI basic protection), prescribe corresponding checks as mandatory.
The use of a specialized service provider to check users’ login information on the operator’s systems against known leakage data therefore offers a clear advantage over the individual checking of login data by each user himself:
Benefits for online service using integrated and automatic login data leak detection
- Time Saving: The individual checking of credentials by each user themselves can be very time-consuming, as the user may have to visit several different platforms and enter their credentials to check whether they have been leaked. A service provider that automates this check can do the job much faster, saving valuable time for users.
- User-friendliness: The checking of credentials can be done proactively in the background and whithout any user interaction. This is much more user-friendly compared to individual checking by each user, as this means they do not have to visit other platforms or perform additional steps. In the event of a compromised login, the user can be automatically prompted for a new, secure password.
- Reliability and Up-To-Dateness: A service provider offering credential verification has a corresponding database of leak data, which also needs to be updated on an ongoing basis. In this way, the service provider reliably checks the user’s access data against known and latest leak data, so that a more accurate statement can be made as to whether the user’s account is at risk. A one-time check against a statically built leak database is not sufficient to protect against future leaks.
- Recurring: It is important that access data is checked on a regular basis to ensure that the latest leak data sets are also used to protect the user accounts. A service provider offering this data can provide operators with appropriate automations to ensure regular auditing and inform users about the status of their credentials and account security.
- Incorporability: A service provider offering access data verification implements this via incorporable interfaces that enable operators to fully integrate access data verification into their own systems. In this way, users can conveniently check their access data via the operator’s platform without having to switch to an external platform.
- Flexibility: Offering the most flexible interfaces possible for access data verification is essential to enable the operator of the online platform to integrate the verification into its existing systems and workflows. This can take place, for example, as part of the login process for a website or a mobile app. However, by means of an API (Application Programming Interface) offered, this can also be done in other process steps. This offers operators flexibility and allows them to conveniently integrate the credential check at times that suit them and with existing infrastructure components.
- Security: A service provider offering access data verification knows about the highly sensitive nature of users’ access data. Special security measures are therefore taken a priori to prevent user access data from falling into the wrong hands. Explicitly refraining from data transmission that takes credentials outside the systems of the operator of an online portal is a fundamental pillar of these measures. Not explicitly transmitting credentials ensures that they cannot be tapped, copied, or stolen. The use of encryption of communication channels, private set interception and anonymization are further important security measures that should be taken by the provider. In this way, operators and users can be sure that the credentials entrusted to them are secure and cannot be misused.
- Scalability: A service provider offering credential verification can offer the necessary scalability through resources and optimized verification processes to reliably perform even a high number of checks.
- Customer support: Software components and tools offered can be tailored to customer needs to a particular degree, and customer wishes can be incorporated into future developments. Direct contact options via hotline, contact form or live chat can be used to obtain appropriate support during installation and operation.
- Comprehensive assistance: A contracted service provider has made it his business to support his customers. He knows about the real-world issues of credential-stuffing and account-takeover attacks and related problems. He can therefore stand by the operators of online platforms as a partner in case of questions or problems. Through its specialization, a service provider can also have corresponding experience in addressing users in the case of compromised login data, and customers can benefit from this accordingly. This gives platform operators the opportunity to enter into a quick and uncomplicated exchange with experts if they have questions about the verification of credentials and associated procedures and processes.
- Privacy Protection: Services that require the sharing of users’ login data outside the online portal operator’s infrastructure jeopardize the security of this data by their very technical approach. Verification of login data on the systems of the online portal operator directly protects the privacy of users, since no additional party gains knowledge of the login data. Local verification also effectively prevents user data from being used for purposes other than pure security screening. Thus, purely technically, no profiling can take place. What is not shared cannot be used elsewhere by contractors or stolen by attackers. By using a service provider to perform the access data check on the operator’s systems, the user’s access data remains in a secure place and cannot be passed on to third parties.
- Cost Savings: Even individual cases of account takeover can be used for fraudulent activities. Resulting direct costs for e.g. chargebacks, loss and profit foregone can be easily quantified. In addition, costs and efforts for customer support in the respective case, reporting to authorities (law enforcement & data protection), documentation, and the final remediation have to be considered. Finally, more indirect expenses for reputation management should not be forgotten. The use of a service provider that performs a centralized check of credentials automatically and thus drastically reduces the risk of account takeover incidents can therefore quickly lead to real cost savings for operators of an online platform.
- Resource Conservation: The individual checking of access data by each user himself can also consume resources, for example if the user has to visit several different platforms to check his access data. A service provider offering this verification can conserve resources by centralizing the verification and thus providing only one platform for all users.
Overall, the use of a service provider that checks users’ login information against known leak data on the operator’s systems thus offers a clear advantage for operators and users of online platforms. This method is an effective, user-friendly, reliable security measure that preserves users’ privacy and reduces the operator’s costs and protects its reputation.
Artikel teilen