11 ms·

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT depa

by bsuvc 5y ago

A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases instead of short cryptic passwords that are hard to remember (think “correct horse battery staple”). This place really is serious about security, I thought. I thanked the system admin and causally said “I’ll be sure to change this to an equally secure pass phrase”. “Oh no,” he said, “we don’t allow people to change their passwords here. You see, we need to be able to log into anyone’s computer if they go on vacation or are out of the office, so we keep an Excel worksheet with everyone’s username and password. So please don’t change your password.” He turns and walks away, and I just sit there stunned, wondering if this was some kind of practical joke. Sadly he was completely serious. I kept the password they gave me for the 3 months I was there, as I was asked to do, knowing that at any time someone could log in as me and do something illegal or unethical. It really did give me a bit of anxiety.

sharperguy 5y ago
Makes you wonder if you could use a tool like GPT-3 to generate grammatically correct passphrases from randomly generated sets of words. E.g. "correct battery horse staple" might become "Correct use of a battery supports the a horse in its staple diet". Thereby keeping the same bits of randomness while making a memorable phrase.
BurningPenguin 5y ago
Yeah, it's the similar in the company i work for. Except that we have a mixed bag of passwords. There are some old ones that are like "mouse" and then there are others like "Gt4x;JlK". We have that list for "maintenance reasons". Doing things, that could easily be done by some GPOs and other cool tricks.
er4hn 5y ago
On the plus side, it also gave you plausible deniability it really was you if you wanted to do something illegal or unethical.
- vmception 5y ago
  chaotic hysterical
- vsareto 5y ago
  Like jeez, GP. Should’ve sold those aerospace secrets to China while you had the chance.
jaywalk 5y ago
This level of negligence should be criminal.
- throwawaygh 5y ago
  The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you could correct everything -- and that's a big if -- the process might take years and the intervening panic would be deafening. The amount of anger might even elicit a hot response. To say nothing of more serious vulnerabilities. We really dodged a bullet on the pipeline ransomware. I'm morbidly curious how bad of a "Cyber 9/11" we'll need before software starts being taken seriously as an engineering field in which practitioners have professional responsibility.
  - ixacto 5y ago
    So you’re saying that is a gigantic target for China and Russia to go after lol. It would mean some change for the which might not be bad but that’s kinda like arguing for terrorism, which would be illegal and actually have enforcement behind it.
    - throwawaygh 5y ago
      No, it's far too large and undivisive a target for China or Russia. They're both too smart for that. They fuck shit up in ways that are partisan and divisive. This is more of an NK/non-state-actor "burn it all down" move.
  - jjeaff 5y ago
    I would assume that a few nation state actors have already hoovered up all that leaked information and have it implemented in a system that is ready to steal identities, drain accounts, and otherwise wreak havoc on a large scale. They are just waiting for the higher ups to pull the trigger if and when they decide to deploy it.
tenebrisalietum 5y ago
Well, was the Excel spreadsheet accessible to everyone? If not, this model could work in some strange way - if someone needs access to your computer, they are provided the password, then it is changed and you and password custodian now have a password not known by everyone else. One side effect of this is that if you know someone else has the password, you're probably very unlikely to do any personal business on that machine.
- noah_buddy 5y ago
  There has got to be a better way, namely, not an excel spreadsheet (maybe vault or LastPass) and not the individual employee's account (e.g. have an IT super user account).
lmilcin 5y ago
A few years back, on day 1 of my new job I was given root access to one of the development boxes. So I ask: "Okay, how do I log in?" The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh) Me: "You mean like production domain, same that we use for our desktop?" IT guy: "Of course! What do you mean, what other domain would you like?" Me: "Can I at least change my password to something else just for the dev environment? Can I log in with SSH key?" IT guy: "No, no, no. Per our SECURITY policy, SSH keys are disabled and you have to use our domain login and password". (another sigh... of course) Me: "Are you aware that when somebody has root access to the box they can do whatever they want including intercepting passwords of all users that log in to that box? In this case, every single developer that ever needs access to dev environment?" IT guy: "That's not true. SSH is encrypted protocol and it is not possible to access passwords". Me: after many tries to explain this to various people from IT, I gave up and set out to intercept all passwords of all IT employees. After I had passwords of almost everybody, I put them all in an excel and sent to IT for "verification". There were a lot of angry people that day wanting me fired... fortunately they came to their senses. Unfortunately, my development box access privileges were revoked.
- 5e92cb50239222b 5y ago
  >sudo su - It's high time for this thing to die. sudo supports this natively since forever: $ sudo -i
  - pepoluan 5y ago
    Huh. TIL. I usually just do `sudo zsh` :-)
  - iso1631 5y ago
    Why
  - not1ofU 5y ago
    Curious, whats the difference and why is sudo -i better? I was unaware of sudo -i (I might as well be a noob though), so I had a quick search to find out more and found this [0] One question, if I may, could there be any situation (that you can think of, off the top of your head) where using sudo -i would be worse then "sudo su -" [0] - https://www.maketecheasier.com/differences-between-su-sudo-su-sudo-s-sudo-i/ https://www.maketecheasier.com/differences-between-su-sudo-s...
deleted 5y ago
[deleted]
stjohnswarts 5y ago
It also gave you plausible deniability which would have stood up in any court.
Traster 5y ago
Pro tip: When you're seeing something really unethical that could eventually rebound on you - write it down. Write down contemporaneously what happened and sign and date it. Much more reliable evidence.
- Buttons840 5y ago
  Send it in an email too. "Hi IT guy and Boss, I'm concerned about blah, but understand people need access to everyone else's computer and account. Yada yada." Don't be difficult, but get an email out there with a time stamp on it and forward all that to your personal account if you can.
  - droopyEyelids 5y ago
    Any UPS store or FedEx should be able to notarize it, in the unlikely event there isn't a registered notary among your coworkers.
- franga2000 5y ago
  Bonus points for writing it digitally and using your favourite proper or janky method of timestamping - dates on paper are meaningless, even with a signature (which is also meaningless itself). Emailing it to someone seems to be the go-to recommendation online, but you might not want to expose the information at the time. Some alternatives, in descending order of jank: a Google Doc, unlisted Pastebin, either of those but only post the hash and keep the file offline, a proper TSP timestamp - the latter is actually near-trivial these days with something like freeTSA.org.
hnburnsy 5y ago
Wow I know that password expiration is on its way out [1] but this is crazy. [1] - https://www.sans.org/blog/time-for-password-expiration-to-die/ https://www.sans.org/blog/time-for-password-expiration-to-di...
GekkePrutser 5y ago
My work is also big on pass phrases but I kinda hate them. It's a lot of extra work to type it every time I unlock my PC. And more characters means there's more chance to make a typo meaning I have to do the whole thing again. And the weird way my brain works I have no issue remembering "G6bH,vIz#amV" so I still do it like that :) Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. What matters is online guessing and that is severely limited in the amount of attempts. I can't wait for passwordless though. I use only smart cards/yubikeys at home and love them.
- yawaramin 5y ago
  What's stopping you from using a random password like 'G6bH,vIz#amV'?
  - GekkePrutser 5y ago
    Well they wanted to set the minimum length at 16 characters, for one :) But in the end they settled on 10 so it's ok. They even made it mandatory to have special chars and numbers if you have less than 16. So in the end it worked out fine for me but it did take some convincing (I was involved with the team that was making the choices). Tbh even if you do have to brute-force, if you know the company is using passphrases, it tends to be similar in terms of difficulty as a complex shorter password to brute force it. Because you can do a combined dictionary attack. And it's more susceptible to targeted attacks e.g. gathering a person's interests on facebook.
- koolba 5y ago
  > Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. A diceware password of 6 words has an incredible amount of entropy. How would you ever brute force its hash? > What matters is online guessing and that is severely limited in the amount of attempts. Belt and suspenders.
mjcl 5y ago
The first place I worked was like this, with the exception of the long complicated passwords. We told people to call the helpdesk to reset their password and would save their password to an Excel sheet. This was improved slightly by rolling out a self-service password change tool that logged the passwords to a database. One day someone that had legitimate access to the password list was fired/quit and the VP decided we needed to have everyone (~800 users, 700 remote) call the helpdesk to reset their password. All the helpdesk calls waiting for a password reset clogged the voice T1 (23 lines) for the office, preventing most calls in or out. Oops. Thankfully when the company came in-scope for sarbanes-oxley the external consultant we hired to help with the audit said there was no way we could continue logging user passwords and stay compliant.
raxxorrax 5y ago
I think OS miss the ability for an admin to log into a user context. I am very hardline defender of privacy and in principle I support privacy advocates already preparing my pyre for even suggesting that of course. But if we are honest an admin can already access relevant data anyway and you do indeed need to use a user context to access certain settings of some applications. This is especially true for less digitally affine users. There are workarounds (Windows->Run as...), but that is sometimes insufficient. About an admin using your user account to start the nukes? That is mostly possible anyway in the usual corporate Windows configuration. He could just change your AD password and log in as you. I would recommend that approach anyway and then force the user to set a new password and informing him why you sabotaged his workstation would also be nice. Far more secure than having the holy grail Excel file.
gspencley 5y ago
The funnier thing about that story is that the passphrase they gave you is not necessarily secure in the first place if we're talking about a scenario where a hash is found. While length is a factor when brute forcing randomness, any words or phrases that commonly appear together in written text are likely to come up in various types of dictionaries that can be used in more sophisticated brute forcing algorithms. "sliding down the" and "tall building" are two parts of that password that contain words very commonly found together. It's not the worst password but it's better to introduce randomness. One strategy to create strong passwords that you can remember is to pick 3 or 4 truly random words from the dictionary that have no logical connection to each other, and to "glue" them together with some numbers that you can remember. I've heard that phone numbers are 7 digits because people can remember up to 7 pieces of information. If that's true then most people should be able to remember a password in the form of: <word1><number1><word2><number2><word3><number3><word4> It does start to break down when you have to remember multiple passwords. So using that format as the master password to a password manager and then letting your password manager generate truly random passwords for everything else is the way to go.
- tlavoie 5y ago
  The nice thing with the lists of multiple randomized words is that there are so many more combinations possible. The numbers, which will be individual digits for most people, add relatively little here. Using EFF's dice-ware page (https://www.eff.org/dice https://www.eff.org/dice) as an example, the long word-list has 7776 entries, with a nicely random way to select them. Four of those words is already a sixteen-digit number in the combinations available. Even their short list of 1296 words would provide pretty reasonable odds. The key is to use something like the dice that takes away our own biases when selecting words.
- jjk166 5y ago
  Really the key is using words that aren't in a dictionary, or at least not the same dictionary. It's pretty trivial for a brute force attack to just take a list of English words and try them in a large number of combinations. But if you have some non-english words, as far as that attacker is concerned its random gibberish. Of course the attacker might use a few languages so just mixing say english and spanish won't do that much better, but if you got some navajo or some quenya you're likely immune to any attack that isn't specifically targeted at you. And it doesn't even have to be a foreign language, even many proper nouns won't show up in a dictionary. For a password like "PoggleExclaimsGeonosianBarahunde" or "Seanbeanfearsburzum-ishikrimpatul" it would take trillions of years to guess a password without very specific pop culture knowledge.

by bsuvc 5y ago

sharperguy 5y ago

Makes you wonder if you could use a tool like GPT-3 to generate grammatically correct passphrases from randomly generated sets of words. E.g. "correct battery horse staple" might become "Correct use of a battery supports the a horse in its staple diet". Thereby keeping the same bits of randomness while making a memorable phrase.

BurningPenguin 5y ago

Yeah, it's the similar in the company i work for. Except that we have a mixed bag of passwords. There are some old ones that are like "mouse" and then there are others like "Gt4x;JlK". We have that list for "maintenance reasons". Doing things, that could easily be done by some GPOs and other cool tricks.

er4hn 5y ago

On the plus side, it also gave you plausible deniability it really was you if you wanted to do something illegal or unethical.

vmception 5y ago
chaotic hysterical
vsareto 5y ago
Like jeez, GP. Should’ve sold those aerospace secrets to China while you had the chance.

jaywalk 5y ago

This level of negligence should be criminal.

throwawaygh 5y ago
The software industry is full of should-be-criminal forms of negligence. Things are already horrendously bad. Basically every American's identity could stolen at this point. If any nation state or other actor decided to operationalize any of the big leaks -- eg OPM or EquiFax -- the ramifications would be catastrophic. Imagine millions of people losing their retirement accounts and all their savings. Even if you could correct everything -- and that's a big if -- the process might take years and the intervening panic would be deafening. The amount of anger might even elicit a hot response. To say nothing of more serious vulnerabilities. We really dodged a bullet on the pipeline ransomware. I'm morbidly curious how bad of a "Cyber 9/11" we'll need before software starts being taken seriously as an engineering field in which practitioners have professional responsibility.
- ixacto 5y ago
  So you’re saying that is a gigantic target for China and Russia to go after lol. It would mean some change for the which might not be bad but that’s kinda like arguing for terrorism, which would be illegal and actually have enforcement behind it.
  - throwawaygh 5y ago
    No, it's far too large and undivisive a target for China or Russia. They're both too smart for that. They fuck shit up in ways that are partisan and divisive. This is more of an NK/non-state-actor "burn it all down" move.
- jjeaff 5y ago
  I would assume that a few nation state actors have already hoovered up all that leaked information and have it implemented in a system that is ready to steal identities, drain accounts, and otherwise wreak havoc on a large scale. They are just waiting for the higher ups to pull the trigger if and when they decide to deploy it.

tenebrisalietum 5y ago

Well, was the Excel spreadsheet accessible to everyone? If not, this model could work in some strange way - if someone needs access to your computer, they are provided the password, then it is changed and you and password custodian now have a password not known by everyone else. One side effect of this is that if you know someone else has the password, you're probably very unlikely to do any personal business on that machine.

noah_buddy 5y ago
There has got to be a better way, namely, not an excel spreadsheet (maybe vault or LastPass) and not the individual employee's account (e.g. have an IT super user account).

lmilcin 5y ago

A few years back, on day 1 of my new job I was given root access to one of the development boxes. So I ask: "Okay, how do I log in?" The IT guy: "What do you mean, you just log in using your personal domain account and then sudo su -. You know what sudo is?" (followed by loud sigh) Me: "You mean like production domain, same that we use for our desktop?" IT guy: "Of course! What do you mean, what other domain would you like?" Me: "Can I at least change my password to something else just for the dev environment? Can I log in with SSH key?" IT guy: "No, no, no. Per our SECURITY policy, SSH keys are disabled and you have to use our domain login and password". (another sigh... of course) Me: "Are you aware that when somebody has root access to the box they can do whatever they want including intercepting passwords of all users that log in to that box? In this case, every single developer that ever needs access to dev environment?" IT guy: "That's not true. SSH is encrypted protocol and it is not possible to access passwords". Me: after many tries to explain this to various people from IT, I gave up and set out to intercept all passwords of all IT employees. After I had passwords of almost everybody, I put them all in an excel and sent to IT for "verification". There were a lot of angry people that day wanting me fired... fortunately they came to their senses. Unfortunately, my development box access privileges were revoked.

5e92cb50239222b 5y ago
>sudo su - It's high time for this thing to die. sudo supports this natively since forever: $ sudo -i
- pepoluan 5y ago
  Huh. TIL. I usually just do `sudo zsh` :-)
- iso1631 5y ago
  Why
- not1ofU 5y ago
  Curious, whats the difference and why is sudo -i better? I was unaware of sudo -i (I might as well be a noob though), so I had a quick search to find out more and found this [0] One question, if I may, could there be any situation (that you can think of, off the top of your head) where using sudo -i would be worse then "sudo su -" [0] - https://www.maketecheasier.com/differences-between-su-sudo-su-sudo-s-sudo-i/ https://www.maketecheasier.com/differences-between-su-sudo-s...

deleted 5y ago

[deleted]

stjohnswarts 5y ago

It also gave you plausible deniability which would have stood up in any court.

Traster 5y ago

Pro tip: When you're seeing something really unethical that could eventually rebound on you - write it down. Write down contemporaneously what happened and sign and date it. Much more reliable evidence.

Buttons840 5y ago
Send it in an email too. "Hi IT guy and Boss, I'm concerned about blah, but understand people need access to everyone else's computer and account. Yada yada." Don't be difficult, but get an email out there with a time stamp on it and forward all that to your personal account if you can.
- droopyEyelids 5y ago
  Any UPS store or FedEx should be able to notarize it, in the unlikely event there isn't a registered notary among your coworkers.
franga2000 5y ago
Bonus points for writing it digitally and using your favourite proper or janky method of timestamping - dates on paper are meaningless, even with a signature (which is also meaningless itself). Emailing it to someone seems to be the go-to recommendation online, but you might not want to expose the information at the time. Some alternatives, in descending order of jank: a Google Doc, unlisted Pastebin, either of those but only post the hash and keep the file offline, a proper TSP timestamp - the latter is actually near-trivial these days with something like freeTSA.org.

hnburnsy 5y ago

Wow I know that password expiration is on its way out [1] but this is crazy. [1] - https://www.sans.org/blog/time-for-password-expiration-to-die/ https://www.sans.org/blog/time-for-password-expiration-to-di...

GekkePrutser 5y ago

My work is also big on pass phrases but I kinda hate them. It's a lot of extra work to type it every time I unlock my PC. And more characters means there's more chance to make a typo meaning I have to do the whole thing again. And the weird way my brain works I have no issue remembering "G6bH,vIz#amV" so I still do it like that :) Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. What matters is online guessing and that is severely limited in the amount of attempts. I can't wait for passwordless though. I use only smart cards/yubikeys at home and love them.

yawaramin 5y ago
What's stopping you from using a random password like 'G6bH,vIz#amV'?
- GekkePrutser 5y ago
  Well they wanted to set the minimum length at 16 characters, for one :) But in the end they settled on 10 so it's ok. They even made it mandatory to have special chars and numbers if you have less than 16. So in the end it worked out fine for me but it did take some convincing (I was involved with the team that was making the choices). Tbh even if you do have to brute-force, if you know the company is using passphrases, it tends to be similar in terms of difficulty as a complex shorter password to brute force it. Because you can do a combined dictionary attack. And it's more susceptible to targeted attacks e.g. gathering a person's interests on facebook.
koolba 5y ago
> Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. A diceware password of 6 words has an incredible amount of entropy. How would you ever brute force its hash? > What matters is online guessing and that is severely limited in the amount of attempts. Belt and suspenders.

mjcl 5y ago

The first place I worked was like this, with the exception of the long complicated passwords. We told people to call the helpdesk to reset their password and would save their password to an Excel sheet. This was improved slightly by rolling out a self-service password change tool that logged the passwords to a database. One day someone that had legitimate access to the password list was fired/quit and the VP decided we needed to have everyone (~800 users, 700 remote) call the helpdesk to reset their password. All the helpdesk calls waiting for a password reset clogged the voice T1 (23 lines) for the office, preventing most calls in or out. Oops. Thankfully when the company came in-scope for sarbanes-oxley the external consultant we hired to help with the audit said there was no way we could continue logging user passwords and stay compliant.

raxxorrax 5y ago

I think OS miss the ability for an admin to log into a user context. I am very hardline defender of privacy and in principle I support privacy advocates already preparing my pyre for even suggesting that of course. But if we are honest an admin can already access relevant data anyway and you do indeed need to use a user context to access certain settings of some applications. This is especially true for less digitally affine users. There are workarounds (Windows->Run as...), but that is sometimes insufficient. About an admin using your user account to start the nukes? That is mostly possible anyway in the usual corporate Windows configuration. He could just change your AD password and log in as you. I would recommend that approach anyway and then force the user to set a new password and informing him why you sabotaged his workstation would also be nice. Far more secure than having the holy grail Excel file.

gspencley 5y ago

The funnier thing about that story is that the passphrase they gave you is not necessarily secure in the first place if we're talking about a scenario where a hash is found. While length is a factor when brute forcing randomness, any words or phrases that commonly appear together in written text are likely to come up in various types of dictionaries that can be used in more sophisticated brute forcing algorithms. "sliding down the" and "tall building" are two parts of that password that contain words very commonly found together. It's not the worst password but it's better to introduce randomness. One strategy to create strong passwords that you can remember is to pick 3 or 4 truly random words from the dictionary that have no logical connection to each other, and to "glue" them together with some numbers that you can remember. I've heard that phone numbers are 7 digits because people can remember up to 7 pieces of information. If that's true then most people should be able to remember a password in the form of: <word1><number1><word2><number2><word3><number3><word4> It does start to break down when you have to remember multiple passwords. So using that format as the master password to a password manager and then letting your password manager generate truly random passwords for everything else is the way to go.

tlavoie 5y ago
The nice thing with the lists of multiple randomized words is that there are so many more combinations possible. The numbers, which will be individual digits for most people, add relatively little here. Using EFF's dice-ware page (https://www.eff.org/dice https://www.eff.org/dice) as an example, the long word-list has 7776 entries, with a nicely random way to select them. Four of those words is already a sixteen-digit number in the combinations available. Even their short list of 1296 words would provide pretty reasonable odds. The key is to use something like the dice that takes away our own biases when selecting words.
jjk166 5y ago
Really the key is using words that aren't in a dictionary, or at least not the same dictionary. It's pretty trivial for a brute force attack to just take a list of English words and try them in a large number of combinations. But if you have some non-english words, as far as that attacker is concerned its random gibberish. Of course the attacker might use a few languages so just mixing say english and spanish won't do that much better, but if you got some navajo or some quenya you're likely immune to any attack that isn't specifically targeted at you. And it doesn't even have to be a foreign language, even many proper nouns won't show up in a dictionary. For a password like "PoggleExclaimsGeonosianBarahunde" or "Seanbeanfearsburzum-ishikrimpatul" it would take trillions of years to guess a password without very specific pop culture knowledge.