Proton

What is a credential-stuffing attack?

Credential stuffing is a popular type of cyberattack where attackers take login credentials and use them on thousands of websites, hoping to fraudulently gain access to people’s accounts. It’s an effective attack, but fortunately, one that’s easy to prevent. 

This article examines credential stuffing in greater detail and explains how you can protect against it.

What is credential stuffing?

A credential-stuffing attack is when an attacker takes people’s usernames, email addresses, and passwords (the credentials) and uses automated tools to inject them into as many sites as possible (the stuffing). In almost all cases, the attackers get these credentials from an earlier attack or a data breach, like the one that affected Dropbox.

How a credential stuffing attack works

The fact that many people suffer from password fatigue is what makes credential stuffing an effective attack. As many as 65% of people(nueva ventana) reuse their passwords on multiple accounts, meaning if their passwords ever get exposed in a breach, all those accounts would be at risk. 

For example, if you had an account with an online service using jimmysmith92 as your username and password123 as your password, a credential stuffer would use automated software to try as many other services as possible to see if you used that combination of username and password elsewhere. If so, they get easy access to another account.

Credential stuffing is usually categorized as a brute-force attack (where an attacker uses software to “guess” a password by trying every possible combination of letters and symbols) as it relies on the same principle. Only instead of trying every possible password to access a single service, credential stuffing uses a single password and tries it on every website and service.

The regularity of massive data breaches makes it easy for attackers to perform credential stuffing, and while verifiable numbers are hard to find, the prevalence of reused passwords suggests they’re effective. According to access management firm Okta(nueva ventana), 34% of access attempts via its platform are identified as credential-stuffing attacks. 

How to prevent a credential-stuffing attack

As common and successful as they are, there is a surprisingly simple way to protect against credential-stuffing attacks — never reuse your passwords. If you protect every single one of your accounts with a unique and random password, credential stuffing won’t work on any of your accounts — and other brute-force attempts will likely fail, too.

To create strong, random passwords that are almost impossible to crack for most computers, you need to use a password generator. Of course, this leaves the issue of remembering all these new, random passwords, which is nearly impossible for most people.

This is where password managers come in. These are programs that can store passwords for you and then fill them in automatically whenever you need them. There’s no overstating how useful password managers are. They’re a huge upgrade to your digital quality of life, as well as adding to your online security.

How Proton Pass can help

As your password manager contains so much valuable information, it’s a good idea to get one that’s as safe as can be, which is why we developed Proton Pass. Like all Proton products, it uses end-to-end encryption to keep data safe at all times, meaning that even in the unlikely event we do experience a breach, all your data would still be safe.

Proton Pass comes with a built-in password generator, as well as the option to store and autofill passwords and credit cards and even add secure notes. All this information can be shared with friends and family when needed and remain secure.

On top of this, Proton Pass also lets you create email aliases that shield your real email address from marketers and cybercriminals, offering another layer of protection against credential stuffing.

If you would like to be safe from credential stuffing yet also have an easy-to-use password manager that lets you do more than just store passwords, create a free Proton Pass account today.

Proteja su contraseña
Crear una cuenta gratuita

Artículos relacionados

A cover image for a blog describing the next six months of Proton Pass development which shows a laptop screen with a Gantt chart
en
  • Actualizaciones del producto
  • Proton Pass
Take a look at the upcoming features and improvements coming to Proton Pass over the next several months.
The Danish mermaid and the Dutch parliament building behind a politician and an unlocked phone
en
We searched the dark web for Danish, Dutch, and Luxembourgish politicians’ official email addresses. In Denmark, over 40% had been exposed.
Infostealers: What they are, how they work, and how to protect yourself
en
Discover insights about what infostealers are, where your stolen information goes, and ways to protect yourself.
Mockup of the Proton Pass app and text that reads "Pass Lifetime: Pay once, access forever"
en
Learn more about our exclusive Pass + SimpleLogin Lifetime offer. Pay once and enjoy premium password manager features for life.
A cover image for a blog announcing that Pass Plus will now include premium SimpleLogin features
en
We're changing the price of new Pass Plus subscriptions, which now includes access to SimpleLogin premium features.
Infinity symbol in purple with the words "Call for submissions" and "Proton Lifetime Fundraiser 7th Edition"
en
It’s time to choose the organizations we should support for the 2024 edition of our annual charity fundraiser.