,
9 tweets,
2 min read
Read on Twitter
Presentation: Leveraging Users' Engagement to Improve Account Security, by Amine Kamel (@dontlivetwice), Head of Security at Pinterest.
Pinterest pulls in leaked password data from providers or pastes and finds email addresses that match their users. Then the leaked plaintext passwords are hashed and compared to their user hashes. Any matches and they tag the account as a high risk user (HRU).
They assess action needed with new login to HRUs, in hopes of only logging out users who may be actively targeted by attackers. Pinterest looks at factors like source device and IP to further gauge whether it has known history with the valid user or not.
If login comes from untrusted source they then invalidate all active sessions, email user explaining the risk, provide an account recovery link, and prompt them to turn on 2FA. Users who are notified are actually more likely to engage in 2FA enrollment than the average user.
Pinterest invalidates sessions and forces password resets to protect high risk users an average of 5,500 times per day, or 170,000 times a month, with activity spikes correlated with credential stuffing attacks.
Users who don’t generate new logins are still prompted that their password was stolen in a third-party breach. Pinterest ‘nags’ them with an on-screen banner to change their password to something more secure, or to move to using a social login (e.g. Google/Facebook) instead.
They report a 20% engagement rate with users who see the 'password stolen' nag. Many of these users just choose to change their password, with an average of 1,200 per day. Around 1,000 per day migrate to using a Google login and 900 to a Facebook login instead.
So it looks like Pinterest automatically protects more users against active attacks per day, but around 36% of the at-risk users are able to protect their own accounts without being logged off and put through an account recovery process.
Also @PasswordStorage it is mentioned in this presentation that Pinterest uses Bcrypt. Unfortunately I didn’t find evidence that they publish this elsewhere on their site.
