The credential stuffer
The most impersonal adversary in the register, and one of the most successful.
- What they want
- Any account that opens with a credential pair they already have. They are not looking for you specifically and never were.
- How they earn
- Volume. A tiny success rate across an enormous list is still a business, and the accounts that open get used or resold.
- What it costs them
- Effectively nothing. The credentials came from breaches of ordinary services with no connection to this activity.
- How you meet them
- You do not. Your password was leaked years ago somewhere unrelated and is now in a list that gets tried against everything.
- What gives them away
- Nothing, until an account opens. There is no interaction to recognise, which is why this one is handled by prevention only.
- What stops them
- A password used nowhere else, and a second factor. Both are cheap and both are complete answers to this specific adversary.
Why reuse persists
Because the cost is invisible at the moment you pay it. Reusing a password produces no bad outcome that day, that month, or often that year. The consequence arrives long after the decision, attached to a service you have forgotten about, which is a shape people are famously bad at reasoning about.
It is also worse here than in ordinary life. Elsewhere a compromised account is an inconvenience with a recovery process behind it. Here there is no recovery process worth the name, no institution to appeal to, and the account may be holding funds.
What two factor adds, and what it does not
| Attack | Does two factor stop it? |
|---|---|
| A leaked password tried later | Yes, completely. This is exactly the attack it was designed against. |
| A live clone page | No. It collects the password and the code together and replays both while the code is still valid. See the clone operator. |
| A compromised machine | No. Nothing on the account side helps. |
The part people regret
Recovery material, saved at setup, before closing the page, somewhere separate from the password. Recovery without it is limited and often impossible, and the position nobody wants is holding a balance behind a challenge they can no longer answer. Keep it off a single device, out of screenshots, and test once that you can actually produce it.