CG3 - Browser Defender: Password Reuse

The Password Reuse page lists, grouped by domain, alerts generated when an employee reuses their corporate password on an external site, so administrators can assess the risk and take action. Detection occurs entirely in the browser through the Browser Defender extension: the corporate password never leaves the device and is never sent to LibraCyber or stored on its systems (see below). To access the page, open Browser Defender from the sidebar menu and select Password Reuse. Requires Browser Defender active for your company and the Platform Administrator role; detection for a user begins only after their first corporate login through the extension.

This page lets you:

• Get an overview of external domains where the corporate password has been reused, to assess the risk.
• Analyze a domain's history — URL, users involved, and the action taken by each.
• Apply remediation per domain: disable monitoring, prevent marking it as trusted, or archive resolved alerts.
• Export the alert log in CSV.

This page is not designed for: blocking navigation to a site entirely (broader policy in Advanced options), deciding which sites generate browsing or phishing alerts (page Browsing Alerts), or distributing the extension to users (sections Setup and Users).

The page opens on the Reuse Alerts tab, with the domain table sorted by most recent alert: Domain, Alerts (number of alerts), Users (distinct users involved), and the Remediation icon, which summarizes monitoring status: active bell when monitoring is on, crossed-out bell when disabled, prohibition icon when browsing is blocked.

The Search field filters by domain name; the Filter menu narrows it by remediation status: Monitoring active, Monitoring inactive, or Browsing blocked.

Clicking a domain opens the detail panel, showing the latest event and, for each row, URL and User action: alert closed without further action (Alert Ignored) or domain marked as trusted (Domain Trusted) — an individual user choice.

From a domain's detail panel, these actions are available:

The Export button downloads the log in CSV, with columns Domain, URL, User email, User action, and Date; it always reflects the Search/Filter applied.

The Archived Alerts tab collects archived domains. An archived domain automatically reappears in Reuse Alerts if a new alert occurs, or if an administrator manually recovers it: archiving is not permanent.

When a user logs in with their corporate account through the extension, it generates a fingerprint of the password on their device; when the user types text on another site, it generates a fingerprint the same way and compares them locally: a match on an external site generates a password reuse alert.

NOTE: the corporate password, as well as text typed on other sites, never leaves the browser. LibraCyber receives only the domain/URL pair involved — never the password or its fingerprint.

A new alert appears in the list and detail panel almost immediately.

Some elements affecting what is shown on this page are configured elsewhere:

• Ability to mark a domain as trusted — depends on the browsing policy set for that domain/URL in Advanced options: only the Trust option makes this choice available to users.
• Extension distribution — whether users have installed and activated the extension depends on Setup and the extension itself.