Why is password reuse so dangerous, and what attack exploits it?
People use the same password for many services, so a leak at one service lets attackers log into all the others; automated testing of leaked user name and password pairs at other sites is called credential stuffing.
The average person has dozens or hundreds of accounts, from apps and shops to mail and banking. Nobody can memorise a strong, unique password for each, so most people reuse a few. The weakest service then decides the security of all accounts: when a small forum with poor security is breached, the attacker gets e-mail and password pairs that very often also work at the victim's mail or bank.
Credential stuffing automates this: bots try millions of leaked pairs against login pages. It works without any guessing, which is why rate limits and password complexity rules do not stop it.
Countermeasures:
- Unique passwords per service, made practical by a password manager.
- MFA: a leaked password alone is no longer enough.
- Breach checks: comparing new passwords against lists of known-compromised ones (for example via the k-anonymity API of Have I Been Pwned), as NIST requires for password blocklists.
- Passwordless methods, which remove the reusable secret altogether.
Go deeper:
Credential stuffing (Wikipedia) — how the attack works, notable incidents and compromised-credential checking.- OWASP Credential Stuffing Prevention Cheat Sheet — layered defences from MFA to device fingerprinting.
Have I Been Pwned: Pwned Passwords — check whether a password appears in known breaches, without sending it in full.