SetupAI
繁
SourceStalecollected in 44m

Most organizations fail at secure password storage

Read original on The Next Web (TNW)
#cybersecurity#authentication#data-protection

Secure your AI infrastructure: 80% of breaches start with bad password management.

30-Second TL;DR

What Changed

Compromised passwords are the entry point for 80% of breaches

Why It Matters

Poor credential management poses a critical risk to AI-integrated systems, where unauthorized access could lead to data poisoning or model theft.

What To Do Next

Audit your AI platform's API key and credential rotation policies to ensure they meet modern security standards.

Who should care:Developers & AI Engineers

Key Points

  • •Compromised passwords are the entry point for 80% of breaches
  • •Current organizational password storage methods are fundamentally flawed
  • •Need for better credential management to prevent unauthorized AI system access
Key numbers19%80%

Deep Insight

Background and context from public sources — not the original article. 21 sources cited.

Enhanced Key Takeaways

  • •Credential stuffing attacks, which leverage billions of stolen username and password combinations from previous data breaches, are a significant and growing threat, with attackers launching approximately 26 billion attempts monthly and accounting for a median of 19% of all daily authentication attempts on major platforms.
  • •Multi-factor authentication (MFA) is increasingly vulnerable to bypass techniques such as session hijacking, MFA fatigue (prompt bombing), SIM swapping, and Adversary-in-the-Middle (AiTM) attacks, which can steal session tokens or trick users into approving requests.
  • •Artificial intelligence (AI) is being leveraged by attackers to enhance the sophistication of cyberattacks, including crafting highly personalized phishing emails, automating brute-force and credential stuffing attacks, and identifying network vulnerabilities more rapidly.
  • •Many organizations continue to follow outdated password policies, such as mandatory frequent password resets, which can lead users to create weaker, more predictable passwords or reuse them, thereby increasing vulnerability.
  • •The sheer volume of leaked credentials, with billions in circulation from infostealer malware logs and data breaches, makes credential-based attacks economically viable for cybercriminals, even with low success rates.

Technical Deep Dive

  • Hashing Algorithms: Passwords should never be stored in plain text; instead, they must be protected using strong, slow, adaptive hashing algorithms designed for password storage, such as Argon2id, bcrypt, scrypt, or PBKDF2.
  • Salting: A unique, cryptographically random salt must be added to each password before hashing. This prevents attackers from using precomputed lookup tables like rainbow tables and ensures that even identical passwords result in different hashes.
  • Peppering: For an additional layer of security, a 'pepper' – a secret, system-wide value – can be added to the password hash. Unlike a salt, the pepper should not be stored alongside the hashed password but in a separate, secure location like a secrets vault or Hardware Security Module (HSM).
  • Computational Cost (Key Stretching): Modern hashing algorithms are intentionally designed to be computationally intensive and slow. This 'key stretching' makes brute-force attacks significantly more difficult, expensive, and time-consuming for attackers, as it increases the time required to compute each hash.

Future ImplicationsAI analysis grounded in cited sources

Phishing-resistant multi-factor authentication (MFA) and passwordless authentication methods will become industry standards.
The increasing sophistication of MFA bypass techniques and the inherent weaknesses of passwords will drive widespread adoption of more secure alternatives like FIDO2/passkeys and biometric authentication.
AI will continue to escalate the cybersecurity arms race, demanding continuous adaptation from defenders.
Attackers will increasingly leverage AI for automated exploitation, sophisticated social engineering, and rapid vulnerability scanning, requiring organizations to deploy AI-powered defenses and adapt incident response plans.
Organizational password policies will shift towards prioritizing password length and discouraging arbitrary frequent resets.
Updated guidelines from bodies like NIST emphasize that longer passphrases are more secure than complex, frequently changed passwords, which often lead to weaker user choices.

Timeline

1960
First computer password implemented at MIT's Compatible Time-Sharing System (CTSS).
1962
First recorded password-based data breach occurs when CTSS passwords are printed and shared.
1972
Cryptographer Robert Morris invents hashing, a one-way encryption process for passwords.
1995
AT&T invents two-factor authentication, later patented in 1998.
2000s
Popularization of the internet makes passwords a fundamental part of digital security, leading to increased complexity requirements.
2026-03
NIST updates password guidelines, recommending longer passwords/passphrases (12-16 characters), discouraging mandatory expiration, and promoting password managers.
Read original article on The Next Web (TNW)

Weekly AI Recap

Read this week's curated digest of top AI events →

PostLinkedIn

AI-curated news aggregator. All content rights belong to original publishers.
Original source: The Next Web (TNW) ↗

This is a summary, not the original. Read the source, or get the weekly briefing.

The weekly digest

One email a week. Unsubscribe anytime.