Sign in / up

back to article Sysadmin tells user CSI-style password guessing never w– wait WTF?! It's 'PASSWORD1'!

Can you feel it? The weekend's just over the horizon, so it's time for On-Call, The Register's Friday column in which we share readers' tales of literally incredible jobs that produced improbable feats of sysadminnery. This week, meet “Ron” who told us he used to work for a government agency and sent us a story about how, on “ …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *

Page:

  1. Pascal Monett Silver badge

    "They looked for the password on the CD . . ."

    Dear God. Look, I understand that it was a Friday evening but come on, if you send a password-protected file and the password in the same package, it really totally defeats the purpose of the password.

    The last time I had to send protected data I arranged with the recipient to send said data via email, and the password via SMS. Might not be a perfect solution, but it fits the purpose. I'm sure most people would do the same.

    Of course, the password I chose was a tad more complex - which means that, had the data been sent by me, this story would have ended quite differently.

    32 1 Reply
    1. David 132 Silver badge
      Reply Icon
      Pint

      Re: "They looked for the password on the CD . . ."

      You forget, this is government we're talking about. Crapita were almost certainly involved.

      Getting them to encrypt the data at all was a minor miracle; sending the password separately (or encrypting the data with the recipient's public key) would never ever have occurred to them.

      It's Friday, and I find myself explaining the meaning of the term "POETS day" to my American colleagues once again --->

      66 0 Reply
      1. mr_souter_Working
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        the certificate wasn't encrypted - it merely required a password to install it

        Totally bog standard, and when you generate that type of certificate you MUST enter a password - admittedly the password can be a single character, but you do have to provide one......

        I think it's a miracle that it was as complex as PASSWORD1 - I would have assumed password1 as a first guess, or even just 1. Of course, there are no limits on the number of times you can guess the password, so it does make it kind of pointless.

        16 0 Reply
        1. Phil W
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          Yeah, my biggest criticism of the password being PASSWORD1 would be the 1.

          This password was clearly there because the certificate export process required it, not because security concerns mandated it.

          Given that it would have been better to go with "password" "Password" or "PASSWORD" so that it was easier to guess in circumstances like this.

          Given that this certificate was sent on a CD, probably by courier or recorded mail, no extra security was required, if by some chance it didn't make it to the recipient the certificate could be revoked.

          It's up to the recipient to physically secure the CD i.e. lock it in a safe.

          Security is important to get right, where it is needed, but also important to remove and/or simplify where it isn't.

          19 0 Reply
          1. PassingStrange
            Reply Icon

            Re: "They looked for the password on the CD . . ."

            It's quite possible that the actual password was simply "PASSWORD". I've worked with more than one system where anything typed beyond the maximum password length was ignored.

            4 0 Reply
        2. Anonymous Coward
          Reply Icon
          Anonymous Coward

          Re: "They looked for the password on the CD . . ."

          "Totally bog standard, and when you generate that type of certificate you MUST enter a password - admittedly the password can be a single character, but you do have to provide one......"

          No you don't *have* to specify a password. Needing a password means that the certificate is encrypted and that can be removed or not even added in the first place. The -nodes in this command avoids encryption and generates a self signed certificate

          $ openssl req -x509 -new -out cert.crt -keyout cert.key -nodes -days 365

          I suspect that the implementation you use enforces passwords.

          8 0 Reply
          1. really_adf
            Reply Icon

            Re: "They looked for the password on the CD . . ."

            Needing a password means that the certificate is encrypted and that can be removed or not even added in the first place. The -nodes in this command avoids encryption and generates a self signed certificate

            $ openssl req -x509 -new -out cert.crt -keyout cert.key -nodes -days 365

            No, it avoids encryption of the private key (cert.key). This will show you the certificate with requiring any password, even after doing the above without -nodes:

            $ openssl x509 -noout -text -in cert.crt

            Certificates do not contain sensitive data and so do not need encryption. Just ask (for instance) any HTTPS server, it'll happily send you its certificate.

            Private keys are sensitive, of course. Some file formats, eg PKCS#12, include both certificate(s) and private key(s). In PKCS#12 files, the private key(s) are encrypted, and the file itself has a checksum that uses a password to allow validation of the file's integrity. But IIRC the certificate(s) are still not encrypted in this case.

            2 0 Reply
      2. jake Silver badge
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        David 123, take it from a Yank: POETS day is well known here.

        6 1 Reply
        1. David 132 Silver badge
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          @jake: not consistently, it seems! In this corner of Oregon I get blank stares. The funniest was a colleague of mine who tracked me down the following Monday and regaled me with how he'd told his son the meaning of the term, and his son had found it hilarious even though Dad couldn't remember what the P, the E or the T stood for...

          2 0 Reply
        2. Mark York 3 Silver badge
          Reply Icon
          Coat

          Re: "They looked for the password on the CD . . ."

          Scheduling in Canada......

          OK so I'll do your deployment on Friday afternoon, by the time it's finished you'll be able to celebrate Poets Day, but I guess I'll now have to explain what Poets Day is (again)!

          Don't you come that with me, I know perfectly well what Poets Day is (Shes dropped into a thick Bristol accent) & from the sound of your voice, your not too far removed from where I grew up.

          0 0 Reply
      3. Chris Tierney
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        @David123 I suspect your perfect Thumbs up score on this comment will end around 12:30pm BST

        1 1 Reply
    2. My-Handle
      Reply Icon

      Re: "They looked for the password on the CD . . ."

      While I agree with the principle outlined here and would endeavour to follow it myself, real life has taught me otherwise.

      Need to log in to a user's workstation? The password is 1: Under the keyboard, 2: On a post-it stuck to the monitor or, if you're very lucky, written on a notepad in the top drawer under the desk. Number 4, the desired situation of "the user remembering the password" very rarely happens unless somehow enforced.

      I have only once received a password-protected file, a pdf via email, and the password was written in the same email. That's probably a little better than the password for a CD being written on said disc (in that the pdf and the email are separable), but only just.

      31 0 Reply
      1. jake Silver badge
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        I once found a comprehensive list of login/password pairs written in sharpie on the underside of the leaves of a faux ficus in the office of the secretary of a VP. They included complete access to the corporate mainframes (including R&D). Quite a few people got reamed, and I'm absolutely certain that Amdahl's internal security culture was much better by the time Fujitsu bought them ...

        21 1 Reply
        1. Doctor Syntax Silver badge
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          "I once found a comprehensive list of login/password pairs written in sharpie on the underside of the leaves of a faux ficus"

          Why were you looking there?

          23 0 Reply
          1. jake Silver badge
            Reply Icon

            Re: "They looked for the password on the CD . . ."

            I was an consultant doing a security audit. I have no idea why I looked, other than the fact that the fake tree was at arm's length from the secretary's keyboard. I found many other security problems, but that particular one was the worst overall.

            16 1 Reply
          2. Rustbucket
            Reply Icon

            Re: "They looked for the password on the CD . . ."

            Because they weren't pasted under the keyboard where you'd normally expect them to be.

            0 0 Reply
          3. Alan Brown Silver badge
            Reply Icon

            Re: "They looked for the password on the CD . . ."

            "Why were you looking there?"

            If your job includes making sure security is managed, you look for such things - including under the keyboard/back of the monitor/in-out trays/top drawer (which is slightly excusable if it can be and is habitually left locked) or on the inside cover of a book on the nearest reachable shelf (usually the one that looks the most handled, surprise surprise)

            Our standard policy is to lock all the accounts and replace the postit or whatever with one that says "Come and see security. NOW"

            1 0 Reply
        2. anothercynic Silver badge
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          @jake, that's actually impressive... using the leaves of a faux ficus as password list... That they gave full access to the company mainframe is... unfortunate. But the use of the plant shows some thought process. ;-)

          2 0 Reply
      2. HandleAlreadyTaken
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        >Need to log in to a user's workstation? The password is 1: Under the keyboard, 2: On a post-it stuck to the monitor or, if you're very lucky, written on a notepad in the top drawer under the desk.

        And this can be fine, if you understand your security threat; if your attacker has physical access to your office, you have bigger problems. Passwords under keyboards can't be read by hackers in Russia or China, which are in most cases the bigger risk.

        Add the fact that many companies with bad understanding of security require passwords to be at least 75 characters long, contain mixed case letters, digits, and at least two wingdings, and be changed every full moon and you can't reasonably expect users to memorize them.

        14 0 Reply
        1. Alan Brown Silver badge
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          "if your attacker has physical access to your office, you have bigger problems. "

          When was the last time you vetted your cleaning contractor's staff?

          1 0 Reply
    3. Lee D Silver badge
      Reply Icon

      Re: "They looked for the password on the CD . . ."

      Teacher's Pensions will happily send out certificates without passwords, by unencrypted email, to anyone who happens to work at a school.

      If you make a fuss about not being able to install it on more than one computer, they include the private key in the certificate too, so you can export it and move it around multiple computers.

      But then, those certs are client certs used to authenticate to their website which itselfs score an F- on the Qualsys SSL Labs tests and has done for years. Literally everything from SSL1 to vulnerability to everything under the sun. Nobody seems to notice or care.

      P.S. They charge something ludicrous like £80 for each person you need a certificate for, and for re-issues etc.

      28 0 Reply
      1. IrishFella
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        I thought you were joking, good God how do they get away with this - https://www.ssllabs.com/ssltest/analyze.html?d=www.teacherspensions.co.uk

        9 0 Reply
        1. Lee D Silver badge
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          @IrishFella:

          Wow... for four years, they've been F-.

          Oh... hold on... that's their website front-page. The ACTUAL submission website is:

          https://www.ssllabs.com/ssltest/analyze.html?d=tp-online.co.uk&latest

          I thought they'd come up too far in the world! Though they have improved, it's still the WORST site I've ever seen officially.

          Not like they handle MILLIONS OF POUNDS of people's ultra-secure pensions, or anything. Or things like List 99 barred teaching staff lists... Oh... hold on...

          6 0 Reply
          1. Throatwobbler Mangrove
            Reply Icon

            Re: "They looked for the password on the CD . . ."

            I thought List 99 didn't exist since whenever the Criminal Records Bureau was introduced?

            Also; why would the pension fund have a copy of it in the first place?

            1 0 Reply
        2. Alistair
          Reply Icon
          Windows

          Re: "They looked for the password on the CD . . ."

          "good God how do they get away with this"

          It is a pension fund. The lousy security is there so that the pension fund managers can claim that they were raided by "hackers" when it is found to be bereft of funds, and just before they resign and disappear to a small south pacific islands.

          16 0 Reply
      2. Nick Kew
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        Teacher's Pensions ...

        Why should anyone there care if they get defrauded? It's public-sector, so the taxpayer will pick up the tab.

        I expect they periodically get some bright young thing proposing to fix it. Lesson in life - and not rocking the boat - when they get shown the door.

        7 3 Reply
    4. alain williams Silver badge
      Reply Icon

      Re: "They looked for the password on the CD . . ."

      Some 8 years ago I opened a bank account with Santander, they did not understand security:

      * they sent the username for on-line banking in a clear text email; the password was in another email sent 1/2 second later.

      * we went in, took all the documents needed to open a bank account (passport, etc); they took a copy; a month later ''we have lost them, please scan and send the images by email". (I refused to do so)

      * I complained that important, security related documents were lost. They assured me that they were quite safe: but were unable to explain how they knew so since they did not know where they were.

      And so it went on. The account has been closed for many years, final statement showing a NIL balance - but every 6 months I get a letter telling me that there are a couple of quid there (I have checked - there is not).

      Muppets

      26 0 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: "They looked for the password on the CD . . ."

        Had this with TSB after the de-merger from Lloyds.

        Went in and filled all the forms and gave them all the documents to copy.

        Got nothing back for 2 weeks so went in to ask; and got told they had sent it to the wrong department by mistake.

        Had 2nd set of documents made.

        2 weeks later and nothing, so in we go again; oh sorry, we made a mistake and accidentally shredded them.

        Set no. 3 is duly produced, and again we wait.......

        2 weeks later, sorry, we have no record of your application; would you like to make one??

        Oh PISS OFF!!!!

        9 0 Reply
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          Id verification

          I needed to prove my id and was told scanned copies of documents sere nog acceptable and I needed verified copies. Drove 7 miles to the nearest post office. Had a fight with the counter cler who had never heard of the device. Paid £7.50 for her to stamp and sign each copy.What now I asked.Oh just scan and send them too us was the reply. I felt so much better knowing they took security so seriously and were not just ticking boxes

          2 0 Reply
        2. Alan Brown Silver badge
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          "Had this with TSB "

          Rule one: Always get everything in writing. If you can't get it in writing, RECORD the meeting/call (because they will if there's anything in it they can use against you, or will mysteriously lose the recording if it's something you can use against them)

          1 0 Reply
      2. peter 45
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        Santander...Muppets? Tell me is is not so.

        All ID information gone missing a couple of weeks after giving it to them? So when exactly that happened to me and they told me that it had never happened before, they were lying? Who knew?

        How about answering the security question of 'whats your address' and to be told I got it wrong. Then finding out they had mixed up my old address and new address. Then being blamed for giving them the wrong information when they were the ones who copied the (correct) address from the utility bill.

        Finally finding a piece of paper containing another customers account details and address attached to the back of a bunch of photocopying they gave me.

        Santander. Only found in the same sentence with 'Security' and 'Data Protection' with the word 'fuckwits' appended.

        4 0 Reply
        1. anothercynic Silver badge
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          Call them by their old name, please... Abbey. Abbey bloody National.

          0 0 Reply
      3. ssharwood
        Reply Icon

        Re: "They looked for the password on the CD . . ."

        I recently opened a bank account and was told - by a teller who could see my password in plaintext - that my password was too long and complex. She suggested I pick a simpler password intsead to avoid forgetting my properly complex password. This is why we can't have nice things.

        5 0 Reply
        1. Alan Brown Silver badge
          Reply Icon

          Re: "They looked for the password on the CD . . ."

          "....told - by a teller who could see my password in plaintext"

          PLEASE name and shame that bank.

          2 0 Reply
    5. Naselus
      Reply Icon

      Re: "They looked for the password on the CD . . ."

      "if you send a password-protected file and the password in the same package, it really totally defeats the purpose of the password."

      Unlike using the word 'Password' as the password, because that's totally in keeping with Best Practice.

      12 0 Reply
    6. Alfred
      Reply Icon

      Re: "They looked for the password on the CD . . ."

      It does, but sometimes (maybe not in this case) there's no reason at all for the data to be password protected; there's simply a blanket demand that all data be password protected.

      I sent someone a list of suppliers I'd cut and paste from the internet. Policy was that all data being sent out had to be password protected. Duly zipped it in a password protected zipfile, named "thePasswordIsBeans", with "password = beans" written on the CD.

      Policy obeyed, data protected to the level required.

      15 0 Reply
    7. TheRealRon
      Reply Icon

      Re: "They looked for the password on the CD . . ."

      I am pretty sure that the password had been sent in a separate letter as good practice would dictate, but we never found it. If only they hadn't chosen such a numpty password it would have been almost competent behaviour from <unnamed outsourced provider>.

      2 0 Reply
  2. T. F. M. Reader

    Movie stuff

    The story seems unfinished. Did the hero get the girl in the end?

    27 0 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Movie stuff

      Paid and Layed? You don't; expect much from a Friday :D

      22 0 Reply
      1. CrazyOldCatMan Silver badge
        Reply Icon

        Re: Movie stuff

        Paid and Layed

        No - she turned him down for not being able to spell..

        20 0 Reply
    2. TheRealRon
      Reply Icon

      Re: Movie stuff

      I did not get the girl. But I did get paid on time which pleased my wife.

      5 0 Reply
  3. defiler

    I'm unintentionally awesome at work regularly

    At least on a weekly basis. It's a shame that managers, users, basically anybody outside the thin seam of experienced techies ever realises. Until I've left, I suppose...

    18 0 Reply
    1. Rich 11
      Reply Icon

      Re: I'm unintentionally awesome at work regularly

      "You don't know what you've got 'til it's gone"

      9 0 Reply
    2. mr_souter_Working
      Reply Icon

      Re: I'm unintentionally awesome at work regularly

      wouldn't count on anyone realising after you leave either - I left my previous job just over a year ago, and only the techs that I worked with (and still ask for my advice on the odd occasion) realise how much work I did.

      25 0 Reply
      1. defiler
        Reply Icon

        Re: I'm unintentionally awesome at work regularly

        Ach - I bumped into an old boss who'd bumped me. Long, bitter story...

        He did volunteer, though, that since I was away everything kept breaking. People had problems with all sorts of things. All because I wasn't there spinning the right plates at the right times. They had no idea how much of what I did in that place.

        30 0 Reply
        1. Doctor Syntax Silver badge
          Reply Icon

          Re: I'm unintentionally awesome at work regularly

          "I bumped into an old boss who'd bumped me."

          Sometimes it works the other way round. In this case the boss was actually a client of the company I'd been working up to about 9 months previously. The conversation more or less went "Would you like to come and work for us?". The subsequent interview was more or less "Do you still want the job?". They knew how many plates I'd been spinning.

          11 0 Reply
  4. Anonymous Coward
    Anonymous Coward

    That password is surprisingly similar to the local admin password a certain large company that sets up thin client cloud boxes uses for local admin and leaves in the unattended setup file on the c: drive.

    Incompetence is everywhere...

    10 0 Reply
  5. big_D Silver badge

    One employer

    I worked for had used an external agency to run their support, before I took over the admin role. The agency had reset every employees password to 123456 and set it to "user can't change password". This was so that they could perform "remote support" for the users on their PCs (E.g. setting up network printers, configuring their accounts and copying their settings to new PCs etc.).

    Cleverly, the Exchange accounts all had OWA and ActiveSync activated, so that employees could access their accounts from their smartphones or any web browser...

    The first day was spent locking access to OWA and ActiveSync to all employees without a company phone and forcing those with a phone to change their passwords immediately. The rest of the employees were then informed that the policy had been changed and that they would need to come up with a new password the next morning, when they arrived for work. That caused quite a kerfuffle.

    28 0 Reply
  6. Anonymous Coward
    Anonymous Coward

    I had a boss that kept forgetting his password.

    We'd reset it, he would put in a new one, correctly confirm it, then forget the damned thing the very next attempt. He wanted to use a password manager he found on the internet but corporate policy made that impossible. He kept getting frustrated at forgetting & we kept getting frustrated at having to reset. Then one day the failed attempts & reset requests stopped, he got happy, & we got concerned. Remote into his machine to figure out WTF was going on. We found a "Passwords.Txt" file on his desktop. He had resorted to copy & pasting in the new password into the file, so he could C&P it back when needed. On the one hand we were happy not to have him asking for a reset request every (and I do mean *EVERY* day) but on the other hand it was a serious NoNo. Thankfully someone more senior than I got to explain matters to him, but then it fell on my lowly peon's shoulders to figure out a way to fix it. I ended up asking him if he could remember something from his past that wasn't common knowledge. He thought for a moment, nodded, & changed his password to that memory. It seemed to work for he only required a reminder rather than a reset to get him logged in once again. I later found out that the memory he had used to trigger said password was the name of his first girlfriend. He remembered her rather fondly for very Friday reasons. All his reminder phrase needed to be was "Go visit your girlfriend." Grin, tappity, & Bob's yer uncle.

    28 0 Reply
    1. JimC
      Reply Icon

      Re: something from his past that wasn't common knowledge

      When desperate I used to suggest "OK, look out of the window, what can you see".

      I don't *think* anyone ever typed in "RedFordFocus"...

      9 0 Reply

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like