Slashdot Mirror
The Unspoken Taboo - The Never Expiring Password
anon writes "Every security savvy professional lives with the daily fear of the "never expiring password" being exposed. It's the unspoken taboo, the wide open back door in every corporate network. But no-one ever acknowledges it or discusses it. All applications have got pre-defined passwords that never change. Which means developers, privileged users and hosting third party service providers will all have access to these passwords."
but I feel the need to expose the world's most sophisticated software. The password....is "password"
The locksmith just changed my locks! Did he keep a copy? Is he trustworthy? I don't know... Shit! All applications have passwords? Could someone tell me how to hack notepad? I forgot I needed a password. Someone must have left it unlocked on my rig. Probably a hacker.
!seineew era sreenigne epacsteN
After IT enforced monthly changing passwords requiring so many letters with numbers in between, now I write it on a post-it note and stick it on the monitor.
It was written in 1972, back when all web-based applications were written in machine code. Don't you know anything about computer history?
"Huh? What applications have these?"
Solitare, Minesweeper, Frogger.
What those who want activist courts fear is rule by the people.
>> adult hosting site. One day, just for the hell of it, I pulled out the top ten passwords.
...and the number one porno password...
Drum roll please, Anton...
10. Wank
9. Jerk
8. Milk
7. Yank
6. Spank
5. Rub
4. Beat
3. Whack
2. Jack
1. Off
...that will give a cracker access...
What makes you so sure he's white?
"
Many years ago I was acting as the system administrator for a test system in a large publicly held company. Periodically I would receive a call from someone who had not accessed the system recently, forgot their password and locked themselves out trying to logon. I would look up their password and unlock the system for them and they would go on their merry way.
One day I received a call from a young lady who was in just such a predicament. I looked up her password and informed her that it was 'DOME' and, just to be playful, told her the price for me being gracious enough to unlock her sign-on was an explanation of the meaning of her password. She became very embarrassed over the phone and pleaded that she could never reveal her secret. I of course replied that I would not give her system access until she did. After negotiating for several minutes she finally acquiesced but made me promise to never reveal her password meaning to any of her colleagues to which I gladly agreed.
"Well, what does it mean?", I asked.
She hesitated and then replied, "It's two words."
There was pregnant pause. I unlocked her system and simply said, "Have a nice day".
"
http://www.TheGamerNation.com/Forums
Sadly, I am guilty of this as well.
He wasn't kidding, folks!
In general, it is safe and legal to kill your children. -- POSIX Programmer's Guide
Couldn't they just intall locks?
No, of course not. That would ruin the story.
As long as you rename your cat frequently.
I just wish z8gderfgh wouldn't claw the furniture all the time.
it's a blue bright blue Saturday hey hey
Simple.
Don't store the password in a text file. Put the database login and password in a database. Then put the login and password for that database in another database. And so on.
"Every security savvy professional lives with the daily fear of the "never expiring password" being exposed. It's the unspoken taboo, the wide open back door in every corporate network. But no-one ever acknowledges it or discusses it.
My favorite is the one Dell forces onto corporate customers so they can support them:
Username: admindell
Password: delladmin
All applications have got pre-defined passwords that never change.
All is a pretty strong word. It kinda makes that sentence complete horse shit.
for a company which handled a LOT of oil industry data. They had a windoze domain admin account for sophos to do it's stuff to all the pcs. The password was 'antivirus' an audit team got it on their third guess.
Its been said previously on /. that the best thing to do is make your password the same as your cats name. Mine is 25@jDWQ0! and I change her name every thirty days.
"Flags are bits of colored cloth that governments use first to shrink-wrap people's brains..."
My password is a 256 character random string intialized by digitizing the braying of six donkeys on a semi-daily rotating basis. Once the braying is digitized, and the seven-factor hash table is used to generate the string, it is transfered via secured lasercable to the memory unit of a Sony Aibo. The Aibo has been specially modified with a woodburning unit, and the password is then burned onto a piece of burnished cherry wood, which I am then allowed to view for exactly twelve seconds before it is ground into a very fine sawdust.
All of this takes place behind a triple-secure double-blind firewall, inside a bunker which is encased in twenty-three feet of reinforced concrete and surrounded by a moat with biometrically activated piranhas.
You actually trust the SONY Aibo?
I just want to take over the world...Why does that automatically make me EVIL?