Slashdot Mirror
Bad Password Allowed Swedish Watergate
fredr1k writes "The Swedish Watergate reported earlier this week was possible because of the usage of terrible weak passwords (Swedish) and a not functional IT policy. The Swedish newspaper Göterborgs-Posten reports the source of the password was a partymember who's account was "sigge" with password "sigge" and was "stolen" in march this year. Seasoned Slashdot readers would call it "a-not-so-hard-to-crack-password". "
I've got the same password on my briefcase!
Let's not forget the user who actually had a decent password.
uid: schef
pwd: mmborkburdyhurdymurdy
Those who believe the Internet is private,
find their privates are on the Internet.
There are atleast three ways this password could have been found. a) My brother lives in the town where these passwords were leaked, and he said that their office use unencrypted WLAN. b) The guy who presumably leaked it is in the office right next to the guy called 'Sigge'. c) As the article thinks: The password was very easy to crack. The latest rumour is that the guy who leaked the password (the left party) had a homosexual affair with the guy who *used* the password (the right party).
c++;
Seasoned Slashdot readers
...
vs.
snotty-nosed 11-year-old
So, why was this not modded redundant??
Aw, c'mon folks, let's laugh at ourselves once in a while
They're politicians, not security experts. I hear about this sort of problem all the time... in my own workplace, we talk about the people on the 3rd floor with their one-character passwords and machines that are hacked into on a daily basis.
In the end of course, the system administrator is going to catch heat for not having a strong password policy. Even though he/she would've caught hell if there had been one implemented in the first place.
President Nixon: iam!acrook
President Clinton I: hopemyhusbanddoesntfindoutaboutthepassword
President Bush I: anybodybutmysons
President Clinton II: wishmyhusbandtoldmemonicawasbi8yearsago
President Bush II: 12345
President Quayle I: potatoe
Don't blame me for that last one. My password was "colbertstewart2012".
Here is the real question.. Is it a USER problem or an ADMINISTRATOR problem. Sounds like they need to hire a new IT director with a since of security. If that IT director allows passwords like that he probably also is running a firewall hosted in a Windows XP Pro machine and ICS and no service packs or hot fixes. All of the internal IP addresses are 192.168.x.x because of ICS so I'm sure the server is .1.
Heck, the director might have even turned on Remote Desktop Administration on the box so he could manage it from home without a VPN and the administrator accounts password on that box is either blank, password, or god.
Well, best of luck to their director or whomever is in charge of their computer network.
Obama = Socialism.
This is non-news. What happened was a member of the Social Democrats youth section _gave_ a username and password to a former member in the Liberal Party (which are not liberal at all BTW) youth section, around 2005! Of course, as the Social Democrats are about to lose the election (september 17th) they use this "news" to spread some primitive form of political FUD about the opposition.
That rattling sound you hear is everyone on Slashdot changing their passwords at once.
Slashdot Burying Stories About Slashdot Media Owned
This is a good opportunity to outline a few tips for strong passwords. For example, I use my username twice and the number of states as my password.
And I'm sure a vast increase on post-it notes with cryptic characters stuck on monitors and backs of keyboards.
Since they spelled Göteborg wrong, yeah, it'll be a damn good password.
Yes, Swedish passwords are weak. We Danes have known this for many years; it is inevitable given that the average number of syllables per word in Swedish is 1.22 (scientific studies have shown it!).
"sigge", a duosyllabic password, is an indication that the user was a member of the upper strata of Swedish society, with Abba and Ace of Base.
(NB: I can handle pissed off Swedes, but not moderators lacking the humor gene)
Blearf. Blearf, I say.
- What's the opposite to firewall? - Watergate
Incremental-number passwords are an inevitable side-effect of this sort of policy and, even where password policy is more carefully implemented, the fact that average-joe users have to change it monthly anyway is a chore that WILL lead to short-cuts and, ultimately, weak passwords (or rather, associative passwords that are easy to infer after a little observation).
Try just having a very strict policy on passwords, and scrapping the regular-change part of it. People can be imaginative and obscure once, but ask them to do it regularly and they get sloppy.
Meta will eat itself
"kinda strong" eh? That should be easibly crackable with a simple dictionary attack.
Pffft, nobody can guess my password, 'hunter2'. I know you only see '*******' there, but I actually typed in my real password. This is one feature I'm really glad Slashdot stole from IRC.