4 ms·

We just use "c0mp4nyn4m3" everywhere, unless we just use "companyname". Or the same passwords on multiple servers, or a few well-known passwords which are used

by m0nty 10y ago

We just use "c0mp4nyn4m3" everywhere, unless we just use "companyname". Or the same passwords on multiple servers, or a few well-known passwords which are used again and again. I've tried and failed to change this culture. Why have full-disk encryption if it's secured with companyname/companyname? Why encrypt backups if the password is 12345? Apparently, it's so we can show we've fulfilled our data-protection obligations. I've seen this at every company, large and small, including a defence contractor, I've ever worked at. It's an unwinnable battle.

corecoder 10y ago
Second that. The nicest thing I've seen is at a large company, where you had to go through a very long and time consuming bureaucratic process in order to obtain the password (companyname123, identical for everyone).
- m0nty 10y ago
  I once issued an order to our service desk that qwerty123 was no longer to be given to users as a "temporary" password. They (the users) always said they would change it, but they never did. At another workplace, I took Bruce Schneier's advice about writing down passwords (i.e, not a bad idea, so long as you keep the note safe) and gave credit-card sized, laminated cards to everyone with their unique and random password on it. Strict instructions to keep it in their wallet or purse. So these things turned up all over the place, stuck to desks, keyboards, and furniture next to desks. So much for that one. Unless people are getting fired for this kind of thing, they don't care. I offered to crack my boss's email account to show how insecure our systems were, but he didn't act on it when I succeeded. But I did get the blame for hacking his email account a year after I left the company. Obviously, it was me (they reasoned) since "he's done it before!"
yoo1I 10y ago
It's super useful though. If someone forget's the htaccess login credentials that are shared with a customer, and it's too embarrassing to ask if they remember, you can just run john-the-ripper on it, and seconds later: crisis averted. twitches
Singletoned 10y ago
Pretty much the same for me. At an early job I had at a very large software company (that did banking and hospital software), I was given developer access to a very old intranet application that they had (with the idea that I would tweak it if the need arose). All credentials were stored unencrypted in an Access database, and a little random testing showed that most people used the same password for the intranet as for their main computer account. I've given up trying to change the culture at these places, and just make sure that I'm not part of the problem, and that my objection has been noted (for "I told you so" purposes, later on).
thisisit 10y ago
We use a simpler alternative as password - abc123, I mean what could go wrong. Our accounting and budgeting software was hacked 3 years ago due to it being setup incorrectly and accessible via google search. Since then our security teams have spent more time enforcing smaller rules (comparatively) like blocking flash plugins than asking business users to create stronger passwords. Any attempt to incorporate 2-factor or OTPs is met with "business users time is very precious they cannot be wasting time on using 2-factor or OTP."
- m0nty 10y ago
  They just won't learn, will they? If they've been compromised but still don't want to do the right thing ...
ruler88 10y ago
I feel like security is one of those things where no one cares about it, everyone procrastinates, and then companies invest a lot into it once something bad happens.

by m0nty 10y ago

corecoder 10y ago

Second that. The nicest thing I've seen is at a large company, where you had to go through a very long and time consuming bureaucratic process in order to obtain the password (companyname123, identical for everyone).

m0nty 10y ago
I once issued an order to our service desk that qwerty123 was no longer to be given to users as a "temporary" password. They (the users) always said they would change it, but they never did. At another workplace, I took Bruce Schneier's advice about writing down passwords (i.e, not a bad idea, so long as you keep the note safe) and gave credit-card sized, laminated cards to everyone with their unique and random password on it. Strict instructions to keep it in their wallet or purse. So these things turned up all over the place, stuck to desks, keyboards, and furniture next to desks. So much for that one. Unless people are getting fired for this kind of thing, they don't care. I offered to crack my boss's email account to show how insecure our systems were, but he didn't act on it when I succeeded. But I did get the blame for hacking his email account a year after I left the company. Obviously, it was me (they reasoned) since "he's done it before!"

yoo1I 10y ago

It's super useful though. If someone forget's the htaccess login credentials that are shared with a customer, and it's too embarrassing to ask if they remember, you can just run john-the-ripper on it, and seconds later: crisis averted. twitches

Singletoned 10y ago

Pretty much the same for me. At an early job I had at a very large software company (that did banking and hospital software), I was given developer access to a very old intranet application that they had (with the idea that I would tweak it if the need arose). All credentials were stored unencrypted in an Access database, and a little random testing showed that most people used the same password for the intranet as for their main computer account. I've given up trying to change the culture at these places, and just make sure that I'm not part of the problem, and that my objection has been noted (for "I told you so" purposes, later on).

thisisit 10y ago

We use a simpler alternative as password - abc123, I mean what could go wrong. Our accounting and budgeting software was hacked 3 years ago due to it being setup incorrectly and accessible via google search. Since then our security teams have spent more time enforcing smaller rules (comparatively) like blocking flash plugins than asking business users to create stronger passwords. Any attempt to incorporate 2-factor or OTPs is met with "business users time is very precious they cannot be wasting time on using 2-factor or OTP."

m0nty 10y ago
They just won't learn, will they? If they've been compromised but still don't want to do the right thing ...

ruler88 10y ago

I feel like security is one of those things where no one cares about it, everyone procrastinates, and then companies invest a lot into it once something bad happens.