Password Reuse

mechanism

Password reuse collapses separate accounts into one security boundary: once a shared password leaks, attackers can cheaply test it against unrelated services.

Most people use the same password everywhere. That means an obscure site you barely remember may hold the key to accounts you actually care about.

E1

One secret, many doors

Services keep separate authentication systems, but reuse quietly connects them through a shared secret. After one breach, credential stuffing turns that connection into an automated attack: the leaked credentials are tried elsewhere. This is an economic problem as much as a password problem—the attacker copies an existing credential instead of paying the higher cost of guessing a new one.

E1

Unique does not mean invulnerable

A unique password contains the blast radius; it does not make an account unhackable. A service can still mishandle credentials by confusing hashing with recoverable storage, and other attack paths may remain. Two-factor authentication adds another barrier when a password is exposed.

Break the shared-secret chain

Start with your email account, then your financial and social accounts: replace every reused or predictably varied password with a unique generated one stored in a password manager.

Episodes that teach this