5 ms·

This is a dumb question and want to qualify with my field is medicine, not technology: would one have the same username and password on the web facing side of a

This is a dumb question and want to qualify with my field is medicine, not technology: would one have the same username and password on the web facing side of a website as the backend of things (having access to servers or I have no idea what else one would do)? I have no idea how any of this works, but am curious if this would be the case.

esotericn 7y ago
Could you? Sure. Would you? Not unless you were completely batshit insane.
- Medicalidiot 7y ago
  How often does this happen?
  - petra 7y ago
    I'm sure it happens plenty. people are unaware, forgetful and lazy.
  - hermitdev 7y ago
    Very frequently. Off the cuff, I'd estimate that 99% of not tech-savy users utilize the same password for everything, maybe with subtle variations according whatever service's requirements for a password. Probably among tech savy people, the perecentage is lower, but still higher than it should be. I myself, having been in IT for over 20 years, am guilty of this for non sensitive accounts. For significant accounts, they're randomly generated to the longest and highest degree a service allows. My gmail password, for instance is a 40 character random spread along their allowed characters. I cannot remember it.
    - drewp 7y ago
      It happens (a few times?) in this fun podcast: https://darknetdiaries.com/episode/45/ https://darknetdiaries.com/episode/45/ Admins at game companies used the same password for their remote access to their game company data as they did on some other compromised site, so attackers were able to easily break into the company.
- Medicalidiot 7y ago
  Why would this make you batshit insane? Would a long enough password negate this or would you never want the login to be obscure? I appreciate the answers here!
  - NobodyNada 7y ago
    In general, you shouldn't ever reuse a password for multiple things, no matter how complex the password is (see https://xkcd.com/792/ https://xkcd.com/792/). If your password is leaked (which might not even be your fault), you don't want the attackers getting access to everything. A large website is made up of many different complex, interconnected components, and it would be quite possible for an attacker to compromise a public account without gaining full control of the backend infrastructure is unaffected.

esotericn 7y ago

Could you? Sure. Would you? Not unless you were completely batshit insane.

Medicalidiot 7y ago
How often does this happen?
- petra 7y ago
  I'm sure it happens plenty. people are unaware, forgetful and lazy.
- hermitdev 7y ago
  Very frequently. Off the cuff, I'd estimate that 99% of not tech-savy users utilize the same password for everything, maybe with subtle variations according whatever service's requirements for a password. Probably among tech savy people, the perecentage is lower, but still higher than it should be. I myself, having been in IT for over 20 years, am guilty of this for non sensitive accounts. For significant accounts, they're randomly generated to the longest and highest degree a service allows. My gmail password, for instance is a 40 character random spread along their allowed characters. I cannot remember it.
  - drewp 7y ago
    It happens (a few times?) in this fun podcast: https://darknetdiaries.com/episode/45/ https://darknetdiaries.com/episode/45/ Admins at game companies used the same password for their remote access to their game company data as they did on some other compromised site, so attackers were able to easily break into the company.
Medicalidiot 7y ago
Why would this make you batshit insane? Would a long enough password negate this or would you never want the login to be obscure? I appreciate the answers here!
- NobodyNada 7y ago
  In general, you shouldn't ever reuse a password for multiple things, no matter how complex the password is (see https://xkcd.com/792/ https://xkcd.com/792/). If your password is leaked (which might not even be your fault), you don't want the attackers getting access to everything. A large website is made up of many different complex, interconnected components, and it would be quite possible for an attacker to compromise a public account without gaining full control of the backend infrastructure is unaffected.