Protecting Pinner Passwords
summary
Pinterest detects reused breached passwords with PinRipper (matching Pinterest DB dumps to third‑party breach records) and a reCAPTCHA password check against Google’s ~4 billion leaked credentials, covering tens to hundreds of millions (user DB ~400M) via offline and real‑time flows. High‑risk accounts trigger either engagement modals prompting password change or social login conversion, or programmatic defenses that invalidate passwords, log out sessions on new IP/unknown browser. Post‑ATO analysis shows ~90% impacted accounts use breached creds but a persistent ~28% detection gap.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:13Password security challenges
- 5:11Identifying high-risk users
- 7:50Systems and architecture
- 11:33Lessons and definitions
- 12:51User protection strategies
- 18:49Insights and conclusions
related talks
46mRequiem for the Password
40mFantastic Passwords and Where to Find Them
21mEverything but the User: Reducing Password Reuse
23mFantastic Passwords and Where to Find Them
01h 02mI’m Pwned. You’re Pwned. We’re All Pwned
50mHave I Been Pwned?
31mLog In Through the Front Door: Automating Defense Against...
47mLessons From Billions of Breached Records