Overview
A policy that permits "password1" guarantees that a credential-stuffing list will succeed on a slice of the user base.\nReal protection comes from length over complexity, screening against known breach corpora, rate limiting, and MFA for privileged accounts.\nPassword managers and passkeys remove the human cost of stronger rules.
Indicators of Compromise
Signals that suggest this is present on a system.
- Registration accepting 4-character passwords
- Passwords from common-breach lists accepted
- No throttle on failed logins
Controls that stop it
-
Enforce Multi-Factor Authentication
Require a second factor on every login, and make it phishing-resistant where you can: passkeys, FIDO2 security keys or certificate-based authentication. Push-based MFA is meaningfully better than no second factor, but it is still vulnerable to fatigue and real-time relay attacks. Apply it first to remote access, email and administrative accounts.
-
Rate Limit and Monitor Authentication
Throttle failed logins per account and per source, apply exponential back-off, and alert on volumes that look like automation. Rate limit expensive endpoints such as search, password reset and OTP verification so they cannot be used for enumeration or denial of service. Logging without alerting is not monitoring.