11 ms·
Congressman's phone password is 111111
- ceejayoz 7y agoAaaaaaand that's why these things aren't allowed in the SCIFs.
- deleted 7y ago[deleted]
- breadandcrumbel 7y agoIn a normal company, if an employee have bad practice for data protection and cyber security he might get fired But what happen when it's a congressman? We start to see now more and more data breaches that happens due to lack of basic knowledge in this subject.... Just 3 days ago was reveal that Equifax used 'admin' as username and password for sensitive data. ( https://finance.yahoo.com/news/equifax-password-username-admin-lawsuit-201118316.html https://finance.yahoo.com/news/equifax-password-username-adm...? ) In this case I'm sure that the IT person who's in charge for the system just give zero value to data protection and cyber security.... >According to an industry report by Shred-it, 47% of business leaders cited human error as the main cause of a data breach at their organization https://www.perimeter81.com/blog/network/how-employees-open-the-door-to-hackers/ https://www.perimeter81.com/blog/network/how-employees-open-... Leave beside the fact that someone in this position should have better understanding of cyber security I wonder if they get any kind of training from the government.
- pjc50 7y agoBringing the phones into the "secure" CIF was just the icing on the cake of a straightforward attempt to disrupt the inquiry. It's a bit of direct action, almost like a sit-in. Presumably it's a crime, but not the sort that anyone is likely to be charged with if they have power.
- rvz 7y agoThat is a iPhone X like device, which only has Face ID or a PIN. A PIN is more secure than a fingerprint and Face ID. But at least use a combination of either one with a PIN to make it more secure. Since the device was already on and it directly showed the PIN screen, Face ID is disabled and instead he chooses to only use a very very weak PIN. Oh dear.
- ceejayoz 7y ago> A PIN is more secure than a fingerprint and Face ID... While generally true, this is probably not the case for someone who's regularly using their phone on camera like a Congressional rep.
- falcolas 7y agoEven being caught once entering your passcode on camera is enough to compromise it, regardless of how complex it is. A passphrase would possibly buy you more time (less discernible finger movement on a phone screen), but I would still consider it compromised.
- thrower123 7y agoI'd be curious if Apple had anonymous telemetry that showed what people were picking for their phone unlock PINs. Everyone I've ever seen set one does this same type of thing, either all one number, or they draw a line through the middle. The more advanced maybe use a date like their birthday that they can actually remember. It's just security theater.
- breadandcrumbel 7y agoJust checked what's the most popular PINs... 1234 1111 0000 1212 7777 1004 2000 4444 2222 6969 9999 3333 5555 6666 1122 1313 8888 4321 2001 1010 https://www.pocket-lint.com/phones/news/148224-these-are-the-20-most-common-phone-pins-is-your-device-vulnerable https://www.pocket-lint.com/phones/news/148224-these-are-the... I'm not using any of this, but many of the people I know their PINs (family, girlfriend, close friends) Are actually using something from this list
- tomatotomato37 7y agoYup, not sure why we expect good security practices out of a group who's average age is 60
- kwanbix 7y agoWhy would age determine your intelligence?
- moviuro 7y agoNothing to do with intelligence either. Most people don't grasp the consequences of bad OPSEC, though they can fairly well understand why they should lock their door when away from home. Those people lack education on the topic.
- mcny 7y agoIt was a funny conversation with a senior developer when I noticed he had his business card and his key card to work on the same extensible thingy that you clip on to your pants. I remarked there's a reason why the key cards are unmarked, right? It isn't just individuals who can't into OPSEC though. Soon after this conversation, the company created a policy saying you have to pay $10 to get a new key card if you lose your key card. I thought that was stupid. Now, suddenly you have incentivized people to NOT report they don't have possession of their key card any more. We want people to report the instant they lose access to their key card, not three days later when they have exhausted all options. My understanding is that you can easily reactivate a key card if it is found again and the risk of unreported lost cards outweighs the cost of a new key card.
- moviuro 7y agoAt a previous place, we had one single card for everything: enterprise restaurant, parking entrance, building entrance, Windows session, S/MIME signature & decryption... You were more or less unable to work without that card, so it was immediatly obvious if a card was missing. I also agree with the conclusion (the risk of unreported lost cards outweighs the cost of a new key card).
- duxup 7y agoI tell this story a lot. But I think in the time of smartphones and such it also represents the only real secure site I thought was truly secure from what I knew of it. This was before smartphones were common, but I think it was ahead of its time in that way. I worked for a company that occasionally would service some of our hardware onsite. One customer was a company that did a lot of work for the military and they had "that site" that a few folks visited. Here was how that worked: Nothing except your body and your clothes left the site, anything you brought stayed onsite (laptops that we brought onsite were left behind / effectively disposable, later you couldn't even bring those, they provided one). All that stuff belonged to the military / whomever you interacted with at the site. No electronics, cameras, etc that were not previously improved were allowed and you were told you would not be leaving anytime soon if you had something "unexpected or unauthorized". It was highly suggested that nothing was in your rental car other than your keys, the equipment you needed as they searched the car and the folks would take what they wished. If you realized you had something you didn't want to in the car it was highly suggested you do not turn around if you are at all close to the location and to drive up and immediately tell them you dorked up and brought something. This was a fairly remote location so the probabbly knew you were coming before you saw the gate and the guards didn't like surprises. Upon arrival you parked, were blindfolded and driven from the gate to the site, you never actually saw the outside of the site until you were in the building. You were never alone at anytime. Trips to the bathroom while at the site were monitored... in person by a guard with a rifle. Now all that sounds ominous but everyone reported that the folks there were very professional (not friendly but professional). The point of that whole story was that even a while ago someone said "any electronics" were a threat and decided that they had to go to extremes to limit their access. Still today I think that was the closest to a "sure" policy.
- roenxi 7y ago111111 is perfectly acceptable for a phone password. His password was just broadcast to the entire world; at least using 111111 means that he doesn't have any illusions about how secure it is. Phone passwords are for protecting things from your family.
- davvolun 7y ago??? I think Apple and the FBI disagree https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...
- code_duck 7y ago>Phone passwords are for protecting things from your family. I think what you actually mean is anyone who has physical access to your phone. If you lose your phone or it is taken by authorities, then you are at risk of having strangers access your data.
- roenxi 7y agoStrangers already have access to all my data; I use Gmail [0] for most of my important personal emailing, metadata like website browsing habits is already snoop-able. iMessages might be secure, but there isn't anything substantial there that can't be dug up elsewhere. If this guy was relying on any password to protect his phone from physical access then he is in for a nasty shock - whatever his password was, his adversaries would know it after this video. That fact that it was 111111 doesn't actually change anything. He's in the US government. If he is up to something and he has enemies; it will get leaked. If he doesn't have enemies the lack of security isn't so terrible. His work is supposed to all be in the public eye anyway. [0] https://nakedsecurity.sophos.com/2018/09/06/ungagged-google-warns-users-about-fbi-accessing-their-accounts/ https://nakedsecurity.sophos.com/2018/09/06/ungagged-google-...
- code_duck 7y agoI don't think all of that rationalization constitutes legitimate reasons to not just have a decent password. Generally a random people do not have access to your Gmail account. The fact that the password is so simple makes it much easier to discern the from the video. Just because his work is in the public eye for the government does not mean everything he does on the phone is supposed to be open to the public.
- deleted 7y ago[deleted]
- securingsincity 7y agoI'm not an iPhone user but I thought that Apple warned you about this kind of password. It was covered quite a bit when Kanye was caught with a 000000 password when meeting with Trump. https://www.cnet.com/news/kanye-west-meets-with-trump-reveals-iphone-passcode-is-000000/ https://www.cnet.com/news/kanye-west-meets-with-trump-reveal...
- deleted 7y ago[deleted]
- ceejayoz 7y agoI don't think any PIN is gonna survive the "we've got video of you entering it" attack.
- vuln 7y agoMaybe the phone is attached to a MDM that requires a PIN.
- angry_octet 7y agoThere are lots of orgs with dumb MDM policies, but I doubt Congress is enforcing that one. MDMs usually prevent simple passwords like that (though not equally simple ones like 989898...).
- vuln 7y agoIt looks like they require a PIN but disallow repeating characters. Here's the Security Technical Implementation Guide[0]. [0]https://www.stigviewer.com/stig/apple_ios_8_interim_security_configuration_guide/2014-09-16/finding/V-54243 https://www.stigviewer.com/stig/apple_ios_8_interim_security...
- angry_octet 7y agoThat's DoD but Congress is different. Hard to find my on house.gov though. DoD and ASD still don't like biometrics, in ASDs case because the want to see how it works: https://www.cyber.gov.au/publications/security-configuration-guide-apple-ios-12-devices https://www.cyber.gov.au/publications/security-configuration... Biometrics like iris scanners and palm prints are used everywhere for high security govt installations, but I guess they have been tested by spooks.
- ydnaclementine 7y agoI always thought that Android's 3x3 dot pattern draw password thing was superior against these type of over the shoulder attack, as long as you turn off the tracing effect. Without tracing and if you do it quickly, it just looks like you’re dragging your thumb randomly all over the phone.
- fbnlsr 7y agoMore importantly, Android's pattern draw allows the user to pass on an already traced line. That way you can't guess the pattern just by looking at the screen smudges.
- psychometry 7y agoSorry, I don't understand what you're trying to say. Why can't you guess the pattern by looking at the smudges?
- alasano 7y agoYou can pass over the same point more than once which would obfuscate the direction of the original passes on the smudge.
- q_eng_anon 7y agoquick somebody do the combinatorics on this
- psychometry 7y agoThe number of unique paths is theoretically infinite since the path could be infinitely long, but there's obviously some software limitation on that.
- ok_coo 7y agoBecause the pattern can go back over part of the screen that's already smudged.
- wayneftw 7y agoI don't lock my phone at all. Never have. However, with the new iPhones that don't have a home button, I believe that Apple is forcing you to either use face unlock or a passcode. There is no choice to just leave it unlocked. So, as soon as my iPhone 6s stops working, I will have to choose to: 1) Give in and use my face to unlock. 2) Use a dumb passcode like 000000. 3) Upgrade to the newest iPhone that still has a home button (I think iPhone 8) or 4) Become and Android user.
- berdon 7y ago5) Accept responsibility and lock your device
- abstractbeliefs 7y agoWhy is it that you choose not to? I think it would be helpful to understand your use case and how you balance your personal tolerance for risk and consequences so we can better consider users like yourself.
- _jal 7y ago(Not the OP.) I have an older phone that is basically a home remote for various things. There is no reason for it to lock, it would be annoying.
- Jill_the_Pill 7y agoAlso not the OP, also have an older phone. I am of an older tech generation who sees this type of security as antithetical to anonymity.
- Dragonai 7y agoComments like the parent comment never fail to fascinate me - far and away, I have never seen more uncommon/unusual use cases for pretty much anything than I do on Hacker News. I don't mean that in a negative way at all, I mean it's just amazing how diverse a crowd we have on here and I love how many perspectives we end up seeing in the comments.
- boonez123 7y agoLooks like 777777 to me.
- chooseaname 7y agoExactly. This appears to be an iPhone, so it would be all 7s.
- drtillberg 7y agoThe problem isn't the password or the camera that captured it. The problem is that the phone required a password in that scenario-- same user, phone never left his vicinity, probably not a long interval between uses. Being more selective about when to require a master password is a better protection model IMHO.
- TheHypnotist 7y agoNon-complex passwords are routinely an issue. Unless he's staring at his phone, it's good practice to prompt for a password.
- Redoubts 7y agoI'm really surprised he doesn't just use FaceID in this case.
- lotsofpulp 7y agoConsidering the better protection model doesn't exist yet, and the password is the best option we have, the password is the problem.
- ehsankia 7y agoSoli on the new Pixel 4 could easily allow that.
- jedieaston 7y agoOr fingerprint readers, which most phones have had for years. It's possible that the DoD standards for the phone he has requires that biometrics be disabled.
- _pmf_ 7y agoStill safer than using an off-brand or Smasung fingerprint sensor.
- agumonkey 7y agoare they so easy to pwn ?
- html5web 7y agoCheck this https://www.cnn.com/2019/10/18/tech/samsung-fingerprint-reader-trnd/index.html https://www.cnn.com/2019/10/18/tech/samsung-fingerprint-read...
- angry_octet 7y agoOnly if you teach it your fingerprint after you put the screen protector on.
- diafygi 7y agoI wonder what AI tech is being developed around detecting pin code entry on phones using passive CCTV networks. If you process the feeds for public transit security cameras, I wouldn't be surprised if you can read the pin codes for a huge swath of the population. It would also reduce the need for law enforcement to try to get a suspect to tell them their passcode. Just look up that time they rode the subway 3 weeks ago and watch them enter it.
- Maximus9000 7y agoI often notice this at gas pumps. There are always cameras at gas pumps. If you pay at the pump, then you enter your pin. I shield mine very carefully, but I watch other people and they just punch in their pin without shielding. It's weird because people often shield their pin at a checkout counter because the clerk is right there (sort of) watching. Maybe these people feel at gas pumps, no one is watching... but the CCTV definitely is watching.
- mdszy 7y agoAnd as someone who has worked as a cashier, it is BLATANTLY obvious when someone's pin is 1111 or 1234. No matter how hard they try to shield it.
- Jill_the_Pill 7y agoBut it's not enough to know someone's code. So what if you do? Unless you can get the physical card without the owner knowing, what good would it do you?
- manigandham 7y agoIsn’t the real problem here that this was caught on video? Otherwise it’s just as secure as any other code.
- code_duck 7y agoI think the idea is that it's easily guessed/cracked in ways other than watching him in video.
- philshem 7y agoIf you obtained this phone without seeing the video, a singular oil smudge on the number 1 surely gives it away.
- damq 7y agoThis would imply the only thing he uses his phone for is to type in his passcode.
- manigandham 7y agoIt's a touchscreen phone, not a keypad. Everything would be smudged.
- kerkeslager 7y agoNo, it is not. These sorts of "I'm annoyed that I'm being forced to put in a password so I'll put the easiest one to type" passwords are in even the most basic password dictionaries, and are therefore susceptible to dictionary attack.
- gambiting 7y agoSure, but if your angle of attack is "someone swiped my phone off my desk and wants to unlock it within the next 30 minutes before I wipe it remotely" then 111111 is as good as literally any other 6-digit pin code, unless the attacker just tries 111111. In which case 999999 is probably a better choice.
- dbg31415 7y agoThese are the people who are grilling Zuck? Our communications, privacy, and security, are in good hands! Ugh.
- ceejayoz 7y agoZuck didn't exactly give off an aura of competence at said hearings.
- ChicagoBoy11 7y agoand it won't matter at all!
- jdlyga 7y agoRemind me to change the combination on my luggage
- rbobby 7y agoMe too!!
- rerpha 7y agoand they say millennials are on their phones too much!
- slg 7y agoAnd yesterday over a dozen members of Congress barged into one of the Congressional versions of this site without authorization and while recording video, audio, and taking photos on their personal smartphones. Here is a Twitter thread about why that is such a problem: https://twitter.com/MiekeEoyang/status/1187032800572125191 https://twitter.com/MiekeEoyang/status/1187032800572125191
- emilfihlman 7y ago>That didn’t matter to about two dozen GOP lawmakers led by Rep. Matt Gaetz (R-FL), a close ally of President Trump, who stormed the SCIF in an effort to sit in on the deposition. Republicans have long complained that Democrats haven’t given them enough access to the closed-door depositions, claiming House Intelligence Committee Chair Adam Schiff (D-CA) is running a “kangaroo court.” And sometimes such actions are necessary as highlighted here, even if it costs us some tiny amount of security (in the end, you just pay and form another site like it, it's not like we can't make new ones). There is no doubt both sides are trying to fuck everyone else over. E: that whole thread is just a thinly veiled attempt at blaming republicans.
- ceejayoz 7y agoNecessary? https://www.washingtonpost.com/politics/2019/10/23/heres-why-matt-gaetz-sit-in-stunt-was-particularly-weird/ https://www.washingtonpost.com/politics/2019/10/23/heres-why... > In other words, 1 out of every 4 Republicans in the House can participate in the inquiry hearings anyway. That doesn’t include Minority Leader Kevin McCarthy (R-Calif.), who is also allowed to participate. It does include Rep. Greg Pence (R-Ind.), the brother of the vice president. He sits on the Foreign Affairs committee. > According to a news release sent from Gaetz’s office that was spotted by journalist Marcy Wheeler, 41 Republicans joined Gaetz’s sit-in protest Wednesday. Of that group, more than a quarter — 13 — were members of the three relevant committees and, therefore, allowed to attend the hearings!
- erentz 7y agoA more straightforward reading of their actions is they wanted to intimidate witnesses and hinder testimony to protect their king.
- breakerbox 7y agoIf I were giving a security recommendation to famous people and congresspeople I would recommend using a password like this. You might think it’s incredibly insecure, but imagine this GIF contained that 6 digit number that the congressman uses for all of his accounts. Suddenly, a ton of other services and passwords are vulnerable to an attacker. In reality a lot of iPhones now require authentication at the app level for apps that have sensitive data. To each his own, but knowing how public you are and how many people would want your passcode, I think the best practice is to use something dumb like 6 of the same keys.
- stingraycharles 7y ago> In reality a lot of iPhones now require authentication at the app level for apps that have sensitive data. I'm fairly certain that knowing my passcode would provide access to my email, which can then be used to acquire access to plenty of critical services.
- deleted 7y ago[deleted]
- kobayashi 7y agoThis is itself bad advice. The proper solution is a truly random password, committed to memory, and all others being stored in a password manager, which is itself secured by a separate strong password
- dorfsmay 7y agoThe one thing I miss from CyanogenMod: keyboard key orders scrambled for each use. I wish LineageOS and stock Android added that feature.
- onychomys 7y agoSo who is that? I'm not up on my random member of congress identification skills.
- therealrootuser 7y agoThis. I just went through every picture in the latest available Congressional Pictorial Directory, and I wasn't able to make a 100% sure identification, but my best guess was Rep. Andy Barr (Kentucky).
- rezmeplease 7y agothis really illustrates how we live in a society
- someonehere 7y agoI worked for a well known company today, many years ago when it was smaller. When the IT team created new accounts for employees, it was the standard Pa$$word password for everyone. It was up to the user to change their password. They had no password rotating rules or requirements. Anyway, many years later after I started, IT hires a person who wants to do good while in IT. This person discovers the CEO is still using the day one password he was given. The IT person decides to email the CTO, the director of IT, and the head of HR warning them the CEO is still using his default password. I’m not clear what exactly the wording was, but the IT person skipping over the chain of command was bad enough it got them fired.
- shoo 7y ago> IT person skipping over the chain of command was bad enough it got them fired. Isn't this roughly the opposite of what you want in an org? Otherwise there can be the failure mode of only good news getting reported up, so the folks running the company base their decisions on finely cultivated bullshit and are completely isolated from reality.
- someonehere 7y agoManagement in IT was big on chain of command at that time. If the director of IT was insecure and wanted to filter bad news through him before going further up. Because this person went to the director’s boss, it angered the director.