Usernames and passwords are the actual disease behind most breaches, not the specific password someone chose. Changing a password after a breach doesn't fix the underlying problem, because the username tied to it is already out, and no SMS code, push notification, or one-time password undoes that.

Is our world insane? How many times must people be hit by the same problem before anyone starts thinking differently?

The News Cycle We Can't Look Away From

Whether we admit it to ourselves or not, we all like news. Today's media over-represents the negative side of our reality until we get depressed about how the whole world has gone mad, the opposing political party is running the country into the ground, the planet is dying, and humanity is on the brink of extinction, regardless of the actual state of things. Even when we're trying to avoid it, we all have an addiction to attention-grabbing headlines in one form or another. On some level, living without the news is like being an ostrich burying its head in the sand. Avoiding the unpleasant parts of reality can make us feel safer, more comfortable, more optimistic, but it leaves us vulnerable. It also creates an information vacuum that's hard to resist filling when the right headline comes along. Whether it's a new tragedy, a scandal, or the outcome of the big game, sooner or later we give in.

For me, those irresistible headlines come in the form of cybersecurity incidents and data breach news. These breaches keep getting bigger, costlier, and more painful for more people. After watching people make the same obvious mistakes over and over, I can't help but wonder how much longer this will go on.

The 2.2 Billion Record Megaleak

Recently, Wired reported that hackers were passing around a megaleak of 2.2 billion records, a collection of stolen usernames and passwords dubbed Collections #2-5, drawn largely from earlier breaches at companies like Yahoo, LinkedIn, and Dropbox. From a security perspective, despite its huge size, this isn't really a big deal in itself. Even without this particular collection, the bulk of those leaked credentials were already in the hands of bad actors for a long time. What bothers me isn't that more data fell into the hands of novice hackers with this event, it's that they'll use it to hit easy targets, which is exactly what's happening across the globe.

Some companies at least acknowledge they're under attack. Basecamp experienced a mass-login attack in January 2019, more than 30,000 login attempts in a single hour, and had to reset passwords for the 124 accounts that saw unauthorized access, then remind all their users to protect themselves. That's a smart move. Most companies don't bother, or more likely, don't even know it's happening to them.

Why "Change Your Password" Doesn't Work

The problem is that with all these "smart moves," people are still trying to mask symptoms without curing the disease itself. What's the advice we hear again and again? Change your password. Make it stronger. Use a second factor. These methods do not work. If they did, the number and severity of breaches would be going down, not up.

Wired actually nailed the essence of the problem, even if they didn't emphasize it enough. Look closely at what was leaked and used to breach thousands of companies, in the past, right now, and in the future: a "collection of 2.2 billion unique usernames and associated passwords." Usernames and associated passwords, not passwords alone. It's the combination that matters, one piece used to identify the person, the other to verify them.

The Real Disease

This is the disease at the core of our contemporary user management ecosystem: using usernames and passwords together as both identification and verification. As long as these "infected" systems ask you to type in "something you know," the bad guys can know it too, probably better than you do. Change your password after a breach? You should, but you'll remain vulnerable, because your username is already out there, and no SMS code, push notification, or one-time password will save you from that. Once someone has your username, they're most of the way in.

For a deeper look at why this specific combination is the actual weak point, see Passwords Are Their Own Worst Enemy and 2FA vs MFA vs Strong Authentication.

FAQ

Why doesn't changing your password after a breach fully protect you?
Because the breach typically exposes your username alongside your password, and the username doesn't change. An attacker with your username is already positioned to try it again, with a new leaked password, a guess, or a phishing attempt, none of which a password reset alone prevents.

What was the 2.2 billion record megaleak Wired reported on?
A collection of previously leaked data, dubbed Collections #2-5, compiled largely from past breaches at companies including Yahoo, LinkedIn, and Dropbox, totaling 2.2 billion unique usernames and associated passwords circulating among hackers.

What happened in the Basecamp mass-login attack?
In January 2019, Basecamp detected more than 30,000 login attempts in about an hour, using credentials obtained from prior breaches elsewhere. The attack resulted in unauthorized access to 124 accounts, which Basecamp reset immediately before notifying affected users.

If usernames and passwords are the real problem, what actually fixes it?
Removing the username and password pairing as the method of identification and verification altogether, rather than adding more layers on top of it. See Beyond 2FA: Passwordless Protection That Works for what that looks like in practice.

The Insanity Continues

Each time I see a new headline, I pretty much already know what it's going to say, but I still can't help but look. My morbid curiosity just has to know: how long will the world keep repeating this insanity, changing passwords again and again? It's a mostly futile attempt to protect something that, by design, can't be protected this way. Maybe with each headline there's a glimmer of hope that this time, someone with the power to enable real progress will finally see the obvious truth: insanity isn't a sustainable way for any organization to manage its relationship with its people. The capability to end usernames and passwords already exists. The only question is how many more of these headlines companies like Google, Microsoft, Apple, Amazon, and Facebook will let happen before they use it.