Earlier this year, Google had announced the Password Checkup extension for Chrome to help keep all the online accounts safe from hijacking. The extension displays a warning whenever you sign in to a site using one of over 4 billion usernames and passwords that Google knows to be unsafe due to a third-party data breach. Since the launch, over 650,000 people have participated in our early experiment.
In the first month alone, Google scanned 21 million usernames and passwords and flagged over 316,000 as unsafe – 1.5% of sign-ins scanned by the extension. Google today shared the recent lessons from the launch and announcing an updated set of features for the Password Checkup extension.
Hijackers routinely attempt to sign in to sites across the web with every credential exposed by a third-party breach. If you use strong, unique passwords for all your accounts, this risk disappears. Based on anonymous telemetry reported by the Password Checkup extension, Google found that users reused breached, unsafe credentials for some of their most sensitive financial, government, and email accounts. This risk was even more prevalent in shopping sites (where users may save credit card details), news, and entertainment sites.
In fact, outside the most popular web sites, users are 2.5X more likely to reuse vulnerable passwords, putting their account at risk of hijacking. Users opt to reset 26% of the unsafe passwords flagged by the Password Checkup extension. 60% of new passwords are secure against guessing attacks—meaning it would take an attacker over a hundred million guesses before identifying the new password.
Two new features for the Password Checkup extension
- Direct feedback mechanism where users can inform Google about any issues that they are facing via a quick comment box.
- The second feature gives users even more control over their data and allows users to opt-out of the anonymous telemetry that the extension reports, including the number of lookups that surface an unsafe credential, whether an alert leads to a password change and the domain involved for improving site coverage.
Install Password Checkup extension here.
