3 ms·
I knew an old hack IT guy who had a spreadsheet full of users passwords which he obtained through demanding them when their computers needed fixing. Rotation de
by jimnotgym 6y ago
I knew an old hack IT guy who had a spreadsheet full of users passwords which he obtained through demanding them when their computers needed fixing. Rotation dealt with that particular issue!
Then somewhere else I read an IT policy that said 'You will be assigned a password by IT, do not change it.'
I have seen numerous cases of IT support asking users passwords to make fixing a machine more permanent. I have seen more than one where they kept that record.
I have also seen lots of cases of, 'I have their passwords so I can log in to their email when they are away'. We know it is stupid, but these smart people didn't.
That is why I still rotate passwords, I know some will be compromised internally. I do it on a slow schedule though.
- hobs 6y agoI have worked for several companies where when I started they actively promoted this practice to make it "easier" for devs to "fix" things. Each time it has been a huge political battle to get people to do the most basic not insane things to have even the most basic security. I bet there's a looot of company websites where CompanyName123 is the default password.
- marcosdumay 6y agoThe fact that all of those are created to circumvent some other stupid and baseless security policy speaks loudly. (Except the second, that one is the policy itself.)