Password Security & Authentication

6 posts · Jun 2012 – Mar 2025

What this trail covers

Cloudflare's password security and authentication mechanisms have evolved to include automatic checking of user passwords against threat intelligence sources that monitor data breaches in other services. If a password is found to be leaked, users are alerted and prompted to reset their password. The system uses password hashes for secure and fast lookups. The platform also encourages the adoption of two-factor authentication (2FA) and plans to expand single sign-on (SSO) capabilities.

All Cloudflare trails

Mar 2025Password reuse is rampant: nearly half of observed user logins are compromisedThis post details the widespread impact of password reuse, focusing on how it affects popular Content Management Systems (CMS), the behavior of bots versus humans in login attempts, and how attackers exploit stolen credentials to take over accounts at scale. It highlights that 41% of successful logins across websites protected by Cloudflare involve compromised passwords, with bots accounting for 95% of login attempts involving leaked passwords. It also provides specific data on WordPress, showing 76% of leaked password login attempts are successful, with 48% of those being bot-driven. The post also reiterates the use of privacy-preserving credential checking service that hashes passwords for comparison against a database of leaked credentials.
Jun 2024Helping keep customers safe with leaked password notificationThis post introduces a new feature that automatically checks user passwords against known data breaches. If a match is found, users are alerted and prompted to reset their password. The system uses password hashes for secure and fast lookups, and provides a grace period of three login attempts before forcing a reset. The post also reiterates the importance of 2FA and mentions future plans for expanding SSO capabilities.
Oct 2021Research Directions in Password SecurityThis post details research into Password Authenticated Key Exchanges (PAKEs), including strong asymmetric PAKEs (saPAKEs) like OPAQUE, to prevent password exposure during authentication and registration. It also introduces the Might I Get Pwned (MIGP) protocol for detecting credential stuffing attacks and credential tweaking.
Dec 2020OPAQUE & PAKE Protocols | Securing the Login ProcessIntroduces and explains the OPAQUE protocol, an asymmetric Password-Authenticated Key Exchange (aPAKE) protocol. OPAQUE allows users to authenticate using passwords without the server ever seeing the plaintext password. Instead, the server stores a salted hash of the password, and the protocol enables a key exchange that proves knowledge of the password without revealing it. This addresses the security vulnerability of servers handling plaintext passwords during login, even over HTTPS, and enhances security by requiring per-user dictionary attacks after a data compromise.
Feb 2018Validating Leaked Passwords with k-AnonymityCloudflare contributed to the 'Pwned Passwords' service by designing and implementing API endpoints that support anonymised range queries. This allows clients to search for breached passwords without disclosing a complete unsalted password hash to the service. The implementation uses k-anonymity by truncating password hashes to create 'buckets', enabling clients to download all leaked hashes within a bucket and perform an offline check. This approach avoids the higher overhead of Private Set Intersection (PSI) techniques.
Advertisement
Feb 2018How Developers got Password Security so WrongThis post introduces a range search API design for checking password reuse without sending raw hashes, contributing to Troy Hunt's Pwned Passwords database. It also discusses the importance of secure password hashing (Argon2, BCrypt, PBKDF2), salting, and the limitations of composition rules and password expiration policies. It advocates for password managers and two-factor authentication, and highlights the need for developers to implement secure password handling practices.
Nov 2012Choosing a Two-Factor Authentication SystemThis post details the evaluation and adoption of Time-based One-time Password (TOTP) algorithm for two-factor authentication (2FA). It explains the mechanics of TOTP, including the use of random keys, synchronized clocks, and SHA hashing for code generation. The post highlights the advantages of the Authy app implementation over Google Authenticator, specifically regarding token revocation, improved clock synchronization logic, and seamless account syncing during phone upgrades. It also mentions the use of SHA-2 and 256-bit keys in Authy compared to SHA-1 and 128-bit keys in Google Authenticator.
Nov 2012Two-factor Authentication Now AvailableIntroduced two-factor authentication (2FA) for all Cloudflare accounts, integrating with Authy's mobile app (iOS/Android) to provide a time-based one-time password (TOTP) as a second layer of security during login. This feature requires users to enter their email, password, and a 7-digit token generated by the Authy app, which is valid for 30 seconds. The Authy app can generate tokens offline. Users can reassociate their account if their phone is lost or replaced. This feature is optional but recommended for enhanced account security.
Jun 2012A note about Kerckhoff's PrincipleThis post introduces and explains Kerckhoff's Principle in the context of security systems, particularly password storage. It emphasizes that the security of a system should rely on the strength of its algorithms (like bcrypt for password hashing) and the secrecy of the keys, not on the secrecy of the system's design or implementation details. It uses the Enigma machine and home security locks as analogies. For password storage, it highlights that the use of bcrypt and random salts is public knowledge, and security relies on the algorithm's resistance to brute-force attacks even if the database is compromised.
Jun 2012Keeping passwords safe by staying up to dateThis post details the evolution of password storage techniques, from plain text and simple hashing to salted hashing and finally to bcrypt. It explains the vulnerabilities of each method, particularly the threat of rainbow tables against simple hashes and the increasing effectiveness of brute-force attacks against salted hashes due to Moore's Law. The adoption of bcrypt is presented as a solution that incorporates a 'cost' parameter to slow down hash computation, making it more resistant to cracking and future-proof against increasing computational power. The post also emphasizes the importance of long, complex passwords.