Abstract: A system and method for bypassing secondary user authentication based at least in part on the detection of a whitelisting deviation from a user pattern are disclosed. In one implementation, the system includes a pattern determination module, a fraudulent login identifier module, a whitelisting deviation detection module and a user authentication generation module. The pattern determination module determines a user pattern. The fraudulent login identifier module identifies a potentially fraudulent login and triggers a secondary authentication challenge. The whitelisting deviation detection module compares user information to the user pattern and determines based on the comparison whether a whitelisting deviation from the user pattern has occurred.

Abstract: A system and method for bypassing secondary user authentication based at least in part on the detection of a whitelisting deviation from a user pattern are disclosed. In one implementation, the system includes a pattern determination module, a fraudulent login identifier module, a whitelisting deviation detection module and a user authentication generation module. The pattern determination module determines a user pattern. The fraudulent login identifier module identifies a potentially fraudulent login and triggers a secondary authentication challenge. The whitelisting deviation detection module compares user information to the user pattern and determines based on the comparison whether a whitelisting deviation from the user pattern has occurred.

Abstract: The compromised password mitigation module comprises a compromised password collection module, compromised password storing module, a logging module, account protection module and user database. The compromised password collection module receives or gathers sets login names, compromised password hashes and hash functions. The compromised password collection module provides this gathered information to the compromised password storing module. The compromised password storing module stores this information in user records in the user database. The compromised password hashes and hash functions are advantageously stored along with the actual password hash. The logging module uses the user records when evaluating access to determine whether a submitted password matches both a compromised password hash and an actual password hash. If a match is found, access to the system is denied and additional protective action is taken by decal protection module. If no match is found, the user is allowed to access the system.

Abstract: A system and method for recovering an account based at least in part on peer attestation are disclosed. In some implementations, the system includes a trusted contact identifier module, a user interaction module, a trusted contact interaction module and a message generation module. The trusted contact identifier module analyzes a contact database of a user and identifies a selection of trusted contacts that satisfied a pre-defined criteria. The user interaction module presents the selection of trusted contacts and receives from the user an input including at least one selected trusted contact and a personalized message composed by the user. The trusted contact interaction module transmits the personalized message and a hyperlink for verifying the identity of the user to the at least one selected trusted contact and receives a response therefrom. The message generation module sends a message to the user in response to receiving the response.

Abstract: Detecting online attacks is described, including identifying one or more events associated with users on a social graph. For each type of event of the one or more events, generating at least one directed acyclic graph (DAG), where each node on the DAG represents a node on the social graph where an event of the type occurs and each edge on the DAG represents a propagation of the event from a first node of the edge to a second node of the edge.

Abstract: The subject matter of this specification can be implemented in, among other things, a method for clustering network addresses that includes receiving data for one or more first network communications from a first network address and one or more second network communications from a second network address. The method further includes determining whether the first network communications and the second network communications include a first number of distinct identifiers in common. The method further includes associating the first network address and the second network address as a cluster based on determining that the first network communications and the second network communications include the first number of distinct identifiers in common.