San Francisco DA Discloses City's Passwords

snydeq writes "The office of San Francisco District Attorney Kamala Harris has made public close to 150 usernames and passwords used by various departments to connect to the city's VPN. The passwords were filed this week as Exhibit A in a court document arguing against a reduction in $5 million bail in the case against Terry Childs. Though they placed the passwords in the public record, city prosecutors do seem to think that they are sensitive. InfoWorld's Paul Venezia, who has been following the case closely, provides further analysis of the technical details in the city's case. 'By themselves, [the passwords] would not be enough to allow anyone to access the network via VPN,' Venezia writes, 'but the fact that the city entered them into evidence is quite shocking. At the very least, they'll have to shut down their VPN access for awhile until they've changed them all and modified the configurations of some large number of VPN clients.'"

Comments

Likely Typical Reaction:

[theshibboleth]

Show me exactly where these "secret" usernames and passwords are... Give me an exact hyperlink! I need them for my... project... and I'm too lazy to rtfa!

An idiot playing a semantic game.

[Anonymous Coward]

A policy requiring users to commit impossible feats of memory isn't "strong" or "secure" in the first place.

He got people to agree with something obvious, then tried to make them feel stupid by redefining the words he used to make what they agreed with into something ridiculous.

What a fucking asshole. Sounds like MS, all right.

So if Childs is tried by a jury of his peers

[WillAffleckUW]

And those peers are knowledgeable network and security people, how many BILLIONS do you think they'll award Childs for the prudent actions he took that the incompetent fools in the SF government violated once they forced him to release the passwords?

I think I'd pencil it in at five billion US dollars (that's about 100 million EU, for those of you with real currencies) ...

Re:RTFA

[loraksus]

The city is probably going to end up eating its words.

They won't. The prosecutor, in an attempt to not look like a Nifong will throw out every juror who doesn't have 12:00 blinking on their VCR.

Then it's the standard "dazzle them with bullshit", "experts whose testimony is either due to incredible incompetence or intentional malice and just happens to favor the prosecution" and rhetoric that infects courtrooms these days.

The judge won't know a TCP packet from an operating system and neither will the jury, unless they lie during jury selection.