Password Management 101. Part B: A quick what if in a hypothetical Data Breach

The Dangers of Reusing Passwords: An Entirely Hypothetical Scenario.

Imagine that you're a hacker looking to gain access to someone's online accounts. You've come across a list of passwords that were recently leaked in a data breach, and you notice that one of the passwords is one that you've seen before - it's a password that you've used on a few of your own accounts and its also linked to a target of yours.

You decide to try using this password to see if it works on any other accounts. You start by searching for the person's email address online, and you quickly find their social media profiles. You try logging into their social media accounts using the password from the data breach, and to your surprise, it works.

Now that you have access to their social media accounts, you start digging deeper. You look through their posts and profile information to see what you can learn about them. You notice that they've posted about their recent vacation to Hawaii, and you see that they've mentioned their love of hiking.

Using this information, you start searching for other online accounts that might be associated with the person. You try using the password from the data breach and information re their love of hiking as part of the login credentials, and to your surprise, it works again - you're getting closer to their financial accounts now.

But you don't stop there. You continue to search for other accounts that the person might have, using the information you've gathered from their social media profiles, the password from the data breach and online searching tools like Spiderfoot, Sherlock and Maltego. You're able to gain access to their email account, their online shopping accounts, and even their work account all using information pooled from the initial breach paired with open source investigation strategies. And a little dose of hacking & profiling skills of course.

You can't believe how easy it was to begin to compromise the person's online accounts, all because they reused a password that was previously exposed in a data breach and continued to reuse personal information across the management of all their personal accounts.

This hypothetical scenario illustrates the dangers of reusing passwords. By using the same password for multiple accounts, you're making it much easier for a hacker to gain overall access to your sensitive information. Instead, you should use a unique, strong password for each of your accounts and consider using a password manager to keep track of them. It may take a little extra effort, but it's worth it to protect yourself against password reuse and the consequences that can come with it.