Research Directions in Password Security
Oct 14, 2021Ian McQuoid, Marina Sanusi, Tara Whalen
Summary
This post details Cloudflare Research's exploration into advanced authentication methods to combat password reuse and credential stuffing attacks. It introduces Password Authenticated Key Exchanges (PAKEs), specifically focusing on Strong Asymmetric PAKEs (saPAKEs) like OPAQUE, which aim to establish secure keys without revealing plaintext passwords to the server. It also highlights the rollout of the Exposed Credential Checks feature in the WAF, powered by the Might I Get Pwned (MIGP) protocol, which detects compromised credentials and variants by using a private membership test protocol and generating password variants.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack