Credential Stuffing and Weak Password Policies

Credential stuffing is when attackers automatically try username-password pairs leaked from another site against your login page. The attacker does not “crack” your password; they use ready-made lists leaked elsewhere. This method feeds on people’s habit of reusing the same password across sites, and it is one of the most common routes to account takeover today.

Why it is so effective

Billions of leaked credential pairs circulate online. If a user reused their email and password on another site and on yours, a leak there exposes your account too. Attackers try these pairs against your login endpoint with automated tools; even a small success rate means many compromised accounts across large lists.

This differs from brute force: brute force tries many passwords against one account; credential stuffing tries known passwords across many accounts. Defences overlap, but with credential stuffing the key issue is that the password may already be valid.

Layers of defence

1. Multi-factor authentication (MFA): the single most effective measure. Even a correct password does not complete login without the second factor. Especially important for admin accounts.
2. Rate limiting and anomaly detection: slow/block many failed attempts from one IP or against one account.
3. Compromised-password checks: at registration and password change, check whether the chosen password appears in known leak lists (e.g., a k-anonymity based query).
4. Bot protection: CAPTCHA or behavioural checks reduce automated attempt traffic, ideally only when suspicious.
5. Generic login error messages: do not distinguish “wrong username” from “wrong password,” which would help attackers enumerate valid users.

Password policy: the modern approach

Current guidance (e.g., NIST SP 800-63B) moves away from “mandatory change every 90 days + complex character rules,” which push users toward predictable passwords. Instead: encourage long passphrases, require change only on a sign of compromise, reject leaked/common passwords, and support password managers (allow paste).

Summary

Credential stuffing tries ready leaked passwords against your login page; the fact that the password may already be valid makes it dangerous. The strongest defence is MFA; combined with rate limiting, compromised-password checks and bot protection, the attack’s success rate drops significantly.

Sources: OWASP Credential Stuffing Prevention Cheat Sheet, NIST SP 800-63B.

Do your login endpoints have rate limiting and brute-force protection? CyberTestify’s active verification assesses these controls on discovered login points.