Protecting Against Breached Credentials in Identity Workflows

The talk looks at credential stuffing, the reuse of usernames and passwords exposed in unrelated breaches against live login pages. The speaker, who works on threat research at an identity platform, explains that attackers use these pairs for account takeover, then harvest personal details from compromised accounts to plan later attacks. He notes that a work email reused on a personal service can also open a path into an employer's systems. Drawing on authentication logs from many customer tenants, he separates opportunistic attackers, who use older public leaks and crude botnets, from patient ones who use fresh leaks, residential IP networks and human-like behavior.

The middle of the talk follows a real attack timeline. Breaches are often disclosed by outsiders rather than found by the victim, and leaked credentials can be added to a breach-detection workflow within minutes of being loaded. The controls discussed include breach credential checks that trigger forced resets or user education, bot detection, rate limiting, risk-based pre-login assessment and multi-factor authentication. He argues that rate limits and impossible-travel alerts miss careful attackers and privacy-minded users, and that SMS and email factors are weak, so defenses should be layered rather than relying on one control.

The audience discussion covered small organizations, where a managed provider's essentials bundle of MFA, awareness training, endpoint protection and email security is often the practical starting point. Questions also touched on whether users should be notified before an attack, with the speaker explaining that stale leaks can be irrelevant and that proactive notification is ultimately the responsibility of the company that held the data. The practical takeaway is to combine breach checks, bot defenses and strong factors, and to choose controls based on what an account protects and how much friction users will accept.