Chrome password extension flagged 1.5 percent scanned logins as insecure

In a month, Google’s Password Checkup extension for Chrome registered that 1.5 percent of all scanned logins used a leaked password. Users reset 26 percent of insecure passwords.

The Password Checkup extension for Chrome scanned 21 million usernames and passwords in its first month of availability. In 316,000 cases, the password turned out to be leaked and therefore unsafe. Google announced the extension in February and 650,000 Chrome users have used it since then.

After the extension’s warning, users reset 26 percent of insecure passwords. According to Google, 60 percent of newly chosen passwords were secure. By this, the company means that they are relatively resistant to ‘guessing attacks’. An attacker would then have to try a guessed password more than a hundred million times to find the correct password.

Specifically, the project aims to prevent users from reusing a weak password for multiple accounts. Anonymous telemetry data from the extension shows that especially for shopping, news and entertainment accounts, vulnerable passwords are reused.

Google is immediately expanding Password Checkup with an input field to provide quick feedback. In addition, users get an opt-out option, which they can use to prevent the transmission of the telemetry data. Google reports investigating ways to implement the extension’s technique in Google products, with which the company seems to hint at building in Chrome.