15

Security Experts the world around all agree that you should not reuse passwords across sites. This is simply a matter of best practice, and it protects you such that if your StackExchange password is stolen, they can't use that to access your bank account.

The general feeling I get from my security friends is that this "advice" is legally bulletproof, and that if their website is hacked, and plaintext passwords are stolen, they don't have to worry about someone suing them because the password that was stolen from their website was also used on that person's banking page. After all, "It's the user's fault for reusing a password!"

Has this belief actually been upheld in court yet? Or is this a firestorm waiting to happen when Amazon turns out to be the victim and they sue some smaller organization for every penny it has?

11
  • 14
    I don't think that you could sue a company if the leaked passwords were misused somewhere else. But in the EU because of the GDPR you sue the company if the password database was not protected using state-of-the-art technology. As passwords are personal data they should be covered by the GDPR.
    – Robert
    Aug 24 at 18:45
  • 1
    If your scenario happens, the website would have enough liability to financially ruin it (unless it was large enough to shoulder multiple fines and lawsuits) even without the question of password reuse….
    – user28517
    Aug 24 at 19:43
  • 2
    There are very few cases on point. Most that are brought at all are settled prior to trial so there are even fewer resolved on the merits to provide guidance and there are fewer still that result in published appellate court decisions that can serve as precedents in future cases. It is an emerging area of law which is an issue of first impression in most jurisdictions. And the jurisdiction in question absolutely does matter, since this is not an area of longstanding uniformity in the law.
    – ohwilleke
    Aug 24 at 20:14
  • 4
    Anyone storing passwords in plain text is criminally irresponsible. Anyone storing anything but a salted hash of the password is criminally irresponsible. It is a blatant violation of minimal security. And in the end, you should think about your customers’ security first.
    – gnasher729
    Aug 24 at 22:44
  • 1
    A password is very, very much Personally Identifiable Information. And just because it is a good idea not to rely on companies to avoid doing stupid things that they can be sued for doesn't mean they can't be sued for doing stupid things.
    – gnasher729
    Aug 25 at 8:46
30

The argument you are making, restated in legal terms, is roughly as follows:

  1. Users have a duty to not reuse passwords.
  2. When a user reuses a password, and their password is subsequently stolen and used to fraudulently access the plaintiff's system, that password reuse becomes the proximate cause of the plaintiff's business injury.
  3. Therefore, our storage of plaintext passwords cannot be the proximate cause, and so we cannot be liable.

This argument is mostly wrong. Leaving aside the fact that you're going to have a tough time convincing a jury of #1, a tort may have more than one proximate cause. Both the password reuse and the plaintext storage were but-for causes of the injury (i.e. if either had not happened, then the injury would not have happened). The injury was foreseeable, because it is well known in the security industry that many users in fact do reuse their passwords, professional advice notwithstanding. In most US states, that's enough to establish proximate cause. In the minority of states using the "direct causation" test, you might be able to characterize the user's password reuse as an intervening cause, and thereby avoid liability.

However, there are other elements of tort law which must be established aside from proximate cause, and so by itself this does not resolve the question of liability. Other defenses might be applicable; for example, the terms of service might contain an indemnification agreement, which (if upheld) would make the user(s) responsible. The defendant might also argue that there is no duty of care, that it was not breached, or that the injury was or should have been de minimis (i.e. that the plaintiff should have taken greater care to prevent damages arising from account hijacking).

11
  • Also, regarding the defenses you mentioned, let's assume that the breach was an extremely high profile breach, and it is possible to prove that the password obtained in the breach and used on the Plaintiff's system could only have come either directly from the user, or from the breach.
    – Catachan
    Aug 24 at 20:36
  • and then there is the duty of care argument, by which the holder of the data must make proper efforts to properly saveguard that data.
    – jwenting
    Aug 25 at 7:00
  • The injury through password reuse is NOT foreseeable to 80% of users.
    – gnasher729
    Aug 25 at 8:48
  • @gnasher729 I think the answer refers to the injury to users being foreseeable by the holder of passwords, not that the users themselves can foresee the injury (meaning, the holder knowingly took on a high risk of user injury). Though, in my opinion, the risk is foreseeable by users, it's just that 80% of them inexplicably refuse to think about it.
    – Clay07g
    Aug 25 at 14:34
  • 1
    @Hasse1987: That parenthetical is intended to clarify the entire sentence, and particularly the "should have been" link (for people who are deathly allergic to Wikipedia).
    – Kevin
    Aug 26 at 0:10
13

If the customer is in the EU (or UK or EEA) and services were offered, targeted or marketed to that area, the GDPR applies. If the organization running the site has an establishment in the EU, the GDPR also applies. If the customer is in California, the CCPA applies. Other US states, including Colorado and Virginia, have recently passed data protection laws somewhat similar to the CCPA. Other jurisdictions may well pass such laws in future.

All these laws require that "appropriate" technical safeguards be used when storing personal data. And yes, passwords are almost surely personal data under these laws. Exactly what is an appropriate level of security is not defined in detail. It depends on the nature of the information involved, and the risks of a possible breach. It also changes with the current state of technology.

Given that security best practice is never to store plaintext passwords, but only salted one-way hashes of passwords, there might be an argument that any system that stores plaintext passwords is not taking appropriate security measures.

The CCPA gives consumers a private right of action if a data breach compromises their information through a failure to take appropriate precautions. This means that individual consumers can sue companies that have breaches due to poor practices for up to $7,500 per consumer. The GDPR allows consumers to complain to a supervisory agency, which can impose significant fines.

This CCPA Case Tracker lists several large data breach cases now in process. It does not say whether passwords were an element of the breach in all cases.

In "Litigating the CCPA in Court" from the law firm of Holland & Knight (July 2020) it is said that:

In the new wave of CCPA data breach cases, plaintiffs have generally pleaded a right to statutory damages, and also often seek restitution and an injunction against defendants' continued (allegedly) improper handling of personal information. Only a small percentage of cases allege actual damages as a result of the purported incident.

6
  • 1
    The German website knuddels.de was fined €20000 in 2018 when they had 808K email addresses and 1.87M unencrypted passwords stolen. See t-online.de/digital/sicherheit/id_84825494/… (in German). They were founded in 1998, I guess they started to store unencrypted passwords back then, and never updated their security. Aug 25 at 6:59
  • 4
    password are not personally identifiable data under the GDPR per se. Problem is many people use names of loved ones (or even their own) as passwords, which names ARE so classified under the GDPR. Email addresses of private individuals certainly are classified such under the GDPR, corporate ones only if the name of the individual can be known through them (thus john.doe@company.com is covered, servicedesk@company.com isn't). The GDPR is a mess and a minefield, I've spent the last several years struggling with its implications for various products.
    – jwenting
    Aug 25 at 7:04
  • 1
    Typo: it's breach, not breech. Aug 25 at 8:27
  • 11
    @jwenting: Using names in non-name fields does not magically make those non-name fields GDPR-protected. Don't spread FUD. This is well-known; if you struggle with simple things like this then you probably should ask your employer for GDPR training.
    – MSalters
    Aug 25 at 8:31
  • 1
    @GuntramBlohm Unrecoverable (i.e., one-way hashed) passwords were the industry standard for password security as far back as 1978. Problem was, that the many thousands of startups and lone programmers rarely bothered to research (let alone implement) any standards. Aug 26 at 11:29
2

Bluntly, the argument is obviously nonsensical. It's so absurd that it can't even be made with a straight face.

Here is how you've described it:

"Security Experts the world around all agree that you should not reuse passwords across sites. This is simply a matter of best practice, and it protects you such that if your StackExchange password is stolen, they can't use that to access your bank account."

Let's try the equal and opposite version of the very same argument:

"Security Experts the world around all agree that you should not store passwords in plaintext. This is simply a matter of best practice, and it protects you such that if your StackExchange password is stolen from storage, they can't use that to access your bank account."

See the problem?

There are two things, both best practices, that everyone is supposed to do to protect from this scenario. You are saying that you can deliberately choose not to do one of them because you can rely on others to do the other. But if that were correct, that argument would apply equally well to users being able to rely on site operators not to store passwords in plaintext.

So anyone who thinks that argument is correct needs to explain why the user can't make the same argument. Because, obviously, they can't both be right.

No such explanation is possible.

And, of course, it would be the site who would have additionally somehow allowed its password database to get stolen. So arguing for a 50/50 split in responsibility won't even work here.

6
  • This answer makes a good deal of sense from an ethical and logical POV, and I have upvoted it. It is a good response to the argument in the question. But it is not a good legal argument. The law often does not follow such apparently common sense logic. Instead one must look at whether the web site operator owes a duty of care to the user, and whether any specific law or general principle imposes liability on the operator. Those would be relevant issues in any actual suit over such an event. Aug 26 at 16:12
  • @DavidSiegel There's a basic principle of law called the "straight-faced principle". It says that you may not make any argument to a court that you cannot make without smirking or cracking a smile. This argument fails that principle. It cannot be made as stated to a court for the reason that I explained. Your argument has to actually support the position you claim it supports to be made at all, otherwise it is an ethical violation to make the argument in the first place. Aug 26 at 16:49
  • I hate to tell you, but to the best of my understanding that is not a legal principle at all, and respected lawyers do often make arguments that seem quite ludicrous. In any case, even if the argument is bad, that does not mean the result is incorrect. The argument that it is the user's fault for not choosing different passwords is not legally sound, but that does not prove that the law in fact imposes liability on the site operator for security violations. One must show some law, specific or general, that actually imposes such liability. Otherwise there is no liability. Aug 26 at 17:35
  • Wait. As a generalized principle, would you say if Person A and Person B both make mistakes, and those mistakes, taken together, allow Malefactor C to harm Person A, then Person A has a cause of action against Person B? Aug 26 at 22:58
  • @Malvolio It depends upon the jurisdiction. There are actually some where showing any fault on the part of the person suing negates any recovery. In most, proportional recovery is possible. But none of that supports the nonsensical argument the OP asked for comment on. (The argument made is that there's no obligation to protect against some bad outcome so long as something else that can make this exact same argument also protects against it. That's obviously wrong both legally and logically.) Aug 26 at 23:35
-1

It was reported (https://nakedsecurity.sophos.com/2012/06/21/linkedin-slapped-with-5-million-class-action-suit-over-leaked-passwords/) that LinkedIn were sued after leaking user passwords. I don't know what the outcome of the case was.

3
  • 1
    This does not indicate whether the suit was justified or not. Anyone can sue over anything, and particularly in a class action, may hope for a legally unjustified settlement. This does not address the question of whether such suits are legally justified. Aug 26 at 16:18
  • My intent was to provide a pointer that people could use for further research; anyone sufficiently motivated should be able to determine the outcome of this action, which might provide an answer to the question. Aug 27 at 18:09
  • That can be useful, but in that case the usual procedure is to leave a comment rather than an answer. An actual answer should attempt to answer the question, please, not just give a starting point. Aug 27 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.