Technology
Microsoft found 44 million accounts using breached passwords
Disclosure
Every product here is independently selected by Mashable journalists. If you buy something featured, we may earn an affiliate commission which helps support our work.
Follow @https://twitter.com/PCMag
PCMag.com is a leading authority on technology, delivering Labs-based, independent reviews of the latest products and services. Our expert industry analysis and practical solutions help you make better buying decisions and get more from technology.
Microsoft has discovered 44 million user accounts are using usernames and passwords that have been leaked through security breaches.
As ZDNet reports, the vulnerable account logins were discovered when Microsoft’s threat research team carried out a scan of all Microsoft accounts between January and March this year. The accounts were compared to a database of over three billion sets of leaked credentials and resulted in 44 million matches.
These accounts were spread between regular user accounts used by consumers (Microsoft Services Accounts) and enterprise accounts in the form of Microsoft Azure AD logins. In response, Microsoft explained, “For the leaked credentials for which we found a match, we force a password reset. No additional action is required on the consumer side … On the enterprise side, Microsoft will elevate the user risk and alert the administrator so that a credential reset can be enforced.”
Microsoft goes on to recommend that, “Given the frequency of passwords being reused by multiple individuals, it is critical to back your password with some form of strong credential. Multi-Factor Authentication (MFA) is an important security mechanism that can dramatically improve your security posture. Our numbers show that 99.9% of identity attacks have been thwarted by turning on MFA.”
Picking a password is always a trade-off between what’s memorable and what’s strong, which is why using a password manager makes so much sense. But we have another problem: security breaches expose passwords and they shouldn’t be used by anyone.
While Microsoft did the right thing resetting the passwords on these account, it currently can’t stop a user selecting a new password that’s also been exposed as part of a past security breach. A positive next move would be to perform a check when a password is entered to see if it appears on a breach list, and if it is, to reject it and request the user pick something else.
This article originally published at PCMag
here
-
Business7 days ago
Google Gemini: Everything you need to know about the new generative AI platform
-
Entertainment5 days ago
Hands-on with the Claude AI app: It’s pleasant to use, but janky
-
Business5 days ago
Haun Ventures is riding the bitcoin high
-
Entertainment6 days ago
‘Bridgerton’: Everything you need to remember before Season 3
-
Entertainment3 days ago
Apple Watch Series 9 vs. SE: A smartwatch skeptic tested both for 13 days
-
Entertainment4 days ago
5 essential gadgets for turning your home into a self-care sanctuary
-
Business4 days ago
Apple: pay attention to emerging markets, not falling China sales
-
Business3 days ago
Google dubs Epic’s demands from its antitrust win ‘unnecessary’ and ‘far beyond the scope’ of the verdict