Credentials

Credentials are the information a service uses to check whether you really are who you claim to be. The best-known form is the combination of username and password. But there are other forms too: a numeric code from an app, a fingerprint, or a long string of characters used by a program instead of a human. What they all have in common is the role of a key. Whoever holds the key gets in – regardless of whether they’re the rightful owner or not. That is precisely where both the benefit and the risk lie.

The key to an entire digital life

Behind a single account today there is often a great deal at stake. An email inbox holds invoices, private messages, and the ability to reset other passwords. That’s why, in the security industry, the email account is considered a master key. Whoever takes it over can gain access to online shops, social networks, and in some cases even bank accounts.

For companies, the stakes are even higher. Stolen employee credentials are one of the most common entry points in major hacking attacks. The attacker then doesn’t need to crack anything – they simply walk in through the front door. To the system, they look like a normal user, which makes the attack hard to detect.

A veritable market exists for stolen credentials. After major data breaches, lists containing millions of combinations are traded online. Attackers automatically try these lists against other services. This works disturbingly often because many people reuse the same password across multiple accounts. Experts call this automated trial-and-error credential stuffing.

What actually happens when you log in

Reputable services do not store passwords in plain text. Instead, they compute what’s called a hash from them, a kind of irreversible fingerprint. It’s easy to calculate the hash from the password, but practically impossible to calculate the password from the hash. When you log in, your input is recalculated and compared to the stored fingerprint. If it matches, you’re granted access.

A password alone has one weakness: it is a single secret. That’s why many services rely on a second factor, usually a code sent to your phone or a fingerprint. An attacker would then need something you know as well as something you possess. This combination is called two-factor authentication.

Newer methods dispense with passwords altogether. With passkeys, your device generates a key pair. The secret part stays on the device; only the public part goes to the service. This means there’s no longer a secret that could be typed out and thereby exposed. Incidentally, a common misconception is that complicated special characters make a password secure. What matters most is length – and that it’s used in only one place.

Password managers, phishing, and AI systems

In everyday life, you encounter credentials every time you log in, and every time your browser warns you that a password has turned up in a breach. A password manager solves the underlying problem most elegantly. It generates a unique, long password for every service and remembers all of them. You yourself only need a single strong master password.

The most common way credentials get lost is phishing. Here, someone sends a fake email containing a link to a replica login page. Anyone who enters their details there hands them directly to the attacker. Text generators have made such emails noticeably more convincing, since clumsy language no longer serves as a warning sign.

In the tech world, credentials also show up as API keys. These are long strings of characters that let a program use an AI service and through which costs are billed. If such a key accidentally ends up in public source code, strangers rack up charges on your bill. Cases exactly like this regularly make the tech news.