My fucking uni is trying to move to passwordless, but you will always need a password to log onto any lab device, and to the wifi, so why?
RarePossum 17 points 3 years ago
newIdentity 7 points 3 years ago
I mean you don't actually need a password for that when it's implemented the right way
metaStatic 13 points 3 years ago
...implemented the right way
see
...you will always need a password
idunnololz 17 points 3 years ago
A website once complained my password contained 3 consecutive letters there were 1 away from each other. This was back when I used sentences for passwords. It was complaining about the word worst because of r-s-t.
TheSaneWriter 9 points 3 years ago
That's wack. Passphrases are second only to random passwords generated by a password generator in terms of security, character proximity doesn't matter with that much length.
weariedfae 2 points 3 years ago
Jesus fuck
Pyrux 9 points 3 years ago
Then they have you make it some 12 character length minimum string with mixed case and special characters and dictionary lookup so it isn't some common phrase but you're also logging in through a telnet instance onto a Unix system.
MaxVerstappen 9 points 3 years ago
As someone in the InfoSec field, I also hate those people.
magic_lobster_party 5 points 3 years ago
Sysadmin: “A clear indication of phishing email is the sense of urgency. We would never send out any email regarding urgent updates that needs immediate action.”
Also sysadmin: “URGENT!!! You must update your system now before Friday!!! Click link here for instructions! Otherwise you will be locked out!”
AnonymousLlama 2 points 3 years ago
Spot on. We're changing XYZ policy and we need everyone to do this training within the week. Wait, why's no one opening my emails
tchotchony 1 point 3 years ago
Then do this to computer-shaped instrument controller systems that have accounts that can not have passwords changed or the application won't run. Or service accounts, so if you pop in after 6 months, nobody knows the current password and the IT guy only comes in 2 hours/week. And that was yesterday. And no, no contact information present...
HairHeel 54 points 3 years ago
- Installs antivirus on servers that wrecks application performance
- installs content filtering proxy that prevents developers from reading “hacking materials” like OWASP documentation
- won’t let developers install anything on their own machines without filing a ticket and waiting 6 weeks
- pushes unannounced antivirus updates that pop up OS security dialogs like “Netscan Antivirus would like to monitor all network traffic. Enter your password to approve”, and is surprised when users don’t enter their passwords.
Your corporate IT guy
senicar 0 points 3 years ago
They usually don't have a choice. They know this stuff is bad, but they need it to demonstrate compliance with XYZ framework so they can fill out the marketing copy so sales can land a contract with some big customer that wants to know why $competitor has better security than you.
demonsword 11 points 3 years ago
Yes, that's true, and hasn't been considered so for a long time
fadedmaster 4 points 3 years ago
Yep. My least secure password is the one I use at work because I'm restricted to 9-12 characters, can't be sequential forwards or backwards including keys next to each other (abc, 123, qwerty), can't begin with a number, must contain at least three numbers, must be at least four characters different from your last twelve passwords, and must be changed every 90 days. Oh and it can't include your first or last name.
Most of my coworkers just use a family members name and then change a few numbers at the end and keep a post it note at their desk with the numbers so they don't forget it.
netvor 1 point 3 years ago
Last time I worked in a company with this policy I actually made it into an advantage.
Sure, having to change password every 3 months was annoying, but honestly I did not see advantage in rotating 2 or 3 passwords because since I would use the password many times a day, getting used to new password was easy enough---using "old new" passwords from 6-9 months ago would not be any easier: it would just mean that I have to remember some password for longer time.
I also realized that if I re-use the expired password elsewhere, I can actually cascade the passwords across my main systems: for example, when password expired at work, I would re-use it for personal e-mail, and re-use that old e-mail password for something less valuable, such as "random" forums.
That way I could keep steady flow of passwords through all my accounts, while at the any time I would always get the muscle memory for free: there would always just one "truly new" password -- and it would be the most used one, hence the fastest one to learn.
Well, of course this assumes some level of security in the systems I used. If my work got hacked (or keylogged) and someone could keep stealing all the passwords for long enough they could use them for all my services :-D If they only got hashes and everyone else used salt, the damage would be limited, though.
Also, counter-productive measures such as "must contain all blah blah" even if it's 15 chars long or worse, limiting password chars or length can make things more complicated. (I think that's why I almost never changed my PayPal password -- I suspect they still don't allow spaces.)
flashgnash 0 points 3 years ago
Oh really? How come?
vzq 5 points 3 years ago
NIST removed password expiration from their recommendations in 2020. Instead they recommend only forcing password changes when compromise is suspected.
The main argument is that they do not make users or systems demonstrably safer and encourage bad password habits.
Reddit_Is_Trash 5 points 3 years ago
I would imagine most users change their password by only 1 character, and maybe even in sequential order.
When time comes to change the password, it becomes password1234 instead of password123. Or password234. Something easy to remember, most users don't care about best security practices, and changing to a similar password is very convenient. Especially if it's "only" for work stuff
geekworking 39 points 3 years ago
Even worse is the CEO.
He needs access to everything and he's far too important to waste time with security.
Judgy_McJudgerson 37 points 3 years ago
“What do you mean this password is too short? I use it for everything!”
wholeofthemoon 31 points 3 years ago
"My files are highly confidential"
password is suburb+suburbpostcode
DragonAce 18 points 3 years ago
I used to have a lady I worked with who was like this. She had the common sense of a fucking carrot and was dumb as shit. What was weird is she was highly skilled in the one job she was hired for, the rest of the time she would click on everything and I would had to fix her computer multiple times a week. One time I tried to walk her thru something on the phone and I told her to click on an icon, her response was "Whats an icon?"
Dubious_Fart 17 points 3 years ago
I bet he also picks up USB sticks from the parking lot and plugs them into his work computer.
Saigonauticon 15 points 3 years ago
On the other side of things, don't you love systems that return "invalid password: password is not unique"?
Nfntordr 14 points 3 years ago
The cybersecurity email tests I get at work are so transparent - Hi user, You have an unpaid invoice, please follow link to pay immediately.
I wish I could I could reply no I don't fuck off but I'd probably get in trouble lol
magic_lobster_party 13 points 3 years ago
At my work the company wanted to show some gratitude and sent out email with free ice cream vouchers to everybody. Many suspected this was just another one of these cybersecurity email tests, so the company had to clarify it’s all real.
I think it’s hilarious the thought about hackers using ice cream as bait. Maybe that would work?
flashgnash 4 points 3 years ago
Evidently not at your company
RickRae 1 point 3 years ago
path: 0 1695068 1700211, hotness: undefined, score: 1, children: 0
The place where I work does these regularly, and you get slammed hard if you fall for one, and frowned at if you don't use the "Report Phishing" button on them.
But the knuckleheads contracted testing out to a company that always sends the tests from the same domain.
So anyone even the slightest bit savvy about spam/phishing/email headers can set an Outlook rule to dump test emails to a special folder and pop an alert.
oshitwaddup 11 points 3 years ago
Clicks on everything or is too scared to click on anything and never learns how to use the software
Crackhappy 4 points 3 years ago
Hey. Password123 is progress, right?
programmerhumor
@lemmy.ml
43787
1628
1576
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
go to feed...
programmerhumor
@lemmy.ml
43787
1628
1576
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
go to feed...
Need the opposite costume, the overly eager sys admin.
save