4 ms·

The advice to try a password of “Intel123” on any protected files says it all. This organisation genuinely deserves whatever is coming for them.

by danw1979 6y ago

Chyzwar 6y ago
This type of passwords are use in almost all big corporations. People are being asked to encrypt things but without password managers or keys management tools.
- jychang 6y ago
  Yeah, I know of plenty of other companies with similar multi-time-use passwords. The data in that zip file probably isn't that confidential.
- yjftsjthsd-h 6y ago
  > People are being asked to encrypt things but without password managers or keys management tools. That doesn't really make me think better of the company; if the company fails to support secure workflows, it's still on them when people fail to use secure workflows.
zenexer 6y ago
It’s mentioned in the Twitter thread that at least some of the files have a password of “I accept” instead. That leads me to believe that the primary purpose might just be to indicate agreement to an NDA.
jnwatson 6y ago
The primary use case for such passwords is not confidentiality. It is to bypass overzealous email virus checkers.
deleted 6y ago
[deleted]
dathinab 6y ago
In my experience password protected files are often password protected for obscure reasons which have nothing to do with the intent of keeping them secret, like: - prevent anti virus from messing with it - keep to some obscure regulations wrt. Contacts or law, where is enough if you can argue the data was encrypted.
- mensetmanusman 6y ago
  If you make zip files in a company, there is never a repository of passwords, because that would be insecure, ergo zip files with other passwords usually are not easy to unzip after 5-10 years when the owner is dead/gone and the passwords are lost.
dade_ 6y ago
For the life of me, I can't understand why people insist on making passwords with the name of the company in them. It's so absolutely stupid, but common.
- lez 6y ago
  Internal marketing
kr99x 6y ago
The number one (by a wide margin) reason for Intel123 is that somebody is trying to email a zip to somebody else, but a mandatory filter notices "bad files" (oh no, executables!) inside the zip and removes it to keep people "safe". So the zip gets a common, known password, and the recipient gets their files in peace. It's not a security measure at all. It's a workaround for braindead IT "solutions" hindering day-to-day operations. The files can be shared via any number non-encrypted channels just fine, but the particular employees trying to share happen to be most familiar with email and the filter doesn't know or care if there are secrets - there are EXECUTABLES! Those are dangerous, don't you know?

The advice to try a password of “Intel123” on any protected files says it all. This organisation genuinely deserves whatever is coming for them.

Chyzwar 6y ago

This type of passwords are use in almost all big corporations. People are being asked to encrypt things but without password managers or keys management tools.

jychang 6y ago
Yeah, I know of plenty of other companies with similar multi-time-use passwords. The data in that zip file probably isn't that confidential.
yjftsjthsd-h 6y ago
> People are being asked to encrypt things but without password managers or keys management tools. That doesn't really make me think better of the company; if the company fails to support secure workflows, it's still on them when people fail to use secure workflows.

zenexer 6y ago

It’s mentioned in the Twitter thread that at least some of the files have a password of “I accept” instead. That leads me to believe that the primary purpose might just be to indicate agreement to an NDA.

jnwatson 6y ago

The primary use case for such passwords is not confidentiality. It is to bypass overzealous email virus checkers.

deleted 6y ago

[deleted]

dathinab 6y ago

In my experience password protected files are often password protected for obscure reasons which have nothing to do with the intent of keeping them secret, like: - prevent anti virus from messing with it - keep to some obscure regulations wrt. Contacts or law, where is enough if you can argue the data was encrypted.

mensetmanusman 6y ago
If you make zip files in a company, there is never a repository of passwords, because that would be insecure, ergo zip files with other passwords usually are not easy to unzip after 5-10 years when the owner is dead/gone and the passwords are lost.

dade_ 6y ago

For the life of me, I can't understand why people insist on making passwords with the name of the company in them. It's so absolutely stupid, but common.

lez 6y ago
Internal marketing

kr99x 6y ago

The number one (by a wide margin) reason for Intel123 is that somebody is trying to email a zip to somebody else, but a mandatory filter notices "bad files" (oh no, executables!) inside the zip and removes it to keep people "safe". So the zip gets a common, known password, and the recipient gets their files in peace. It's not a security measure at all. It's a workaround for braindead IT "solutions" hindering day-to-day operations. The files can be shared via any number non-encrypted channels just fine, but the particular employees trying to share happen to be most familiar with email and the filter doesn't know or care if there are secrets - there are EXECUTABLES! Those are dangerous, don't you know?