Enzoic Navigation
  • Solutions
    • Enzoic Account Takeover Protection
    • Enzoic for Active Directory
    • Enzoic for Active Directory Lite
    • Enzoic Exposure Alerts
    • NIST Password Standards
    • Hospitals & Healthcare Password Policy
  • Tech Docs
    • API – Dev Doc
    • Active Directory – Tech Docs
    • Security Overview
  • FAQ
    • FAQ Overview
    • Active Directory FAQ
  • Resources
    • Get Support
    • What Is Credential Stuffing
    • What Is Account Takeover
    • What is a Cracking Dictionary
    • Intuitive ATO Protection
    • About Strong Passwords
    • Resources
  • Company
    • About
    • Enzoic Blog
    • Threat Intel
    • Contact Us
    • In the News
    • Careers
  • Sign In
  • Get Started
  • Solutions
    • Enzoic Account Takeover Protection
    • Enzoic for Active Directory
    • Enzoic for Active Directory Lite
    • Enzoic Exposure Alerts
    • NIST Password Standards
    • Hospitals & Healthcare Password Policy
  • Tech Docs
    • API – Dev Doc
    • Active Directory – Tech Docs
    • Security Overview
  • FAQ
    • FAQ Overview
    • Active Directory FAQ
  • Resources
    • Get Support
    • What Is Credential Stuffing
    • What Is Account Takeover
    • What is a Cracking Dictionary
    • Intuitive ATO Protection
    • About Strong Passwords
    • Resources
  • Company
    • About
    • Enzoic Blog
    • Threat Intel
    • Contact Us
    • In the News
    • Careers
  • Sign In
  • Get Started
Disney Plus & the Password Reuse Problem

Disney and the Password Reuse Problem

Disney+ Launch: A whole new world of excellent content, the same password reuse problem

Consumers and critics alike have long clamored for the Disney+ streaming service, however, its recent launch has once again exposed the risks with password reuse. Even a mega-brand like Disney has password risks.

An investigation found that less than 48 hours after launch, thousands of exposed Disney+ passwords and accounts were already for sale. It appears the site was targeted by a credential stuffing attack. In other words, cybercriminals took exposed username and password pairs from a previous data breach and then automated the process of trying these compromised credentials to gain access to consumers’ Disney+ accounts, this is known as account takeover.

The reason credential stuffing attacks are successful is that many users continue to reuse passwords across multiple accounts. Recent research from Google found that a staggering 52 percent of people use the same password for multiple accounts, and even worse, 13 percent use the same combination for every account! The sheer scale of a site like Disney+ increases the probability that credential stuffing attacks will be successful.

So what should organizations do?

Expecting human behavior to change quickly is not a good solution as customers and users are just too lax about passwords and protecting their own accounts. Therefore, companies must anticipate that password reuse will continue due to its convenience and add in steps to reduce the risk.

One simple way is to have a pop-up box reminding users at account setup about the importance of selecting a strong, unique password. Companies could also add a link to a free password check tool that allows the user to check if the password has already been exposed.

To reduce the risk from automated attacks, organizations should make good password hygiene a priority and implement a multi-layered approach. There is no panacea to the problem, but by applying a layered approach, the risk of credential stuffing attacks is reduced.

With these credential screening measures, organizations can easily avoid the negative media coverage and more importantly, customer’s would know if their accounts are at risk for account takeover. This would be helpful for Disney’s recent password issue.

In the digital age, hackers covet consumer credentials with the same fervor Darth Vader displayed in trying to turn Luke to the Dark Side. And while it’s impossible for any company to entirely prevent against credential stuffing or other forms of attack, eliminating password reuse goes along way in strengthening the Rebel–that is, consumer–Alliance. May the force be with Disney+.

acccount takeover protectionDisney Plus

Search

Browse blog categories

  • Account Takeover (19)
  • Active Directory (31)
  • all posts (91)
  • Continuous Password Protection (15)
  • COVID-19 (3)
  • Cracking Dictionaries (3)
  • Credential Screening (15)
  • Cybersecurity (36)
  • Data Breaches (12)
  • EdTech (2)
  • Enzoic Customer (2)
  • Enzoic News (7)
  • Enzoic Recognition and Awards (5)
  • Financial Services Cybersecurity (2)
  • Gaming Cybersecurity (1)
  • GDPR (2)
  • Healthcare Compliance (8)
  • Insider Threats (7)
  • Law Firm Cybersecurity (2)
  • Loyalty and Reward Programs Security (1)
  • NIST 800-63 (19)
  • Password Hygiene (5)
  • Password Tips (34)
  • Regulation and Compliance (5)
  • SMB Cybersecurity (7)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Password Strength Meter (Free)
  • Developer Documentation (APIs)

Recent blog posts

  • It’s Passwords, All the Way Down
  • Can AI be Used to Mitigate Human Error?
  • Attacks on Digital Learning
  • How Social Engineering Tactics Can Crack Multi-factor Authentication
  • [ Free Trial ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2020 | Privacy Policy | Acceptable Use

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website