Slashdot Mirror
A Photo Accidentally Revealed a Password For Hawaii's Emergency Agency (qz.com)
An anonymous reader quotes a report from Quartz: In the aftermath of an erroneous missile warning that terrified Hawaiians on Saturday (Jan. 13), the state's emergency management agency has come under increased scrutiny, from the poor design of the software that enables alerts to a particularly slapdash security measure by one of its employees. Old photos from the Associated Press inside the agency's office appear to show an unspecified password on a yellow Post-It note, stuck to a computer monitor. The image, which shows operations manger Jeffrey Wong standing in front of the computer, was taken in July and appeared in articles published at the time about the agency's preparedness in the face of a nuclear threat. The agency verified that the password is indeed real but wouldn't go into specifics on what program the password was supposed to be used for.
"yellow Post-It note, stuck to a computer monitor."
Everybody knows real security can only be had by posting it under the keyboard, where nobody can photograph it.
Duh!
There was no password!!!
The weakest security is always the human involved.
IMHO people posting, sharing or otherwise exposing passwords, should be written up, and eventually fired.
What is the point of a password that is out in the open like this? Are passwords that hard to remember?
I wanna run away screaming!
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
... the mainframe, all programs and all desktops.
warningpoint2 also sounds like the system name as well.
publishing photographs of the insides emergency management and civil defense facilities isn't such a hot idea either. Information wants to be free.
Joshua gets into the system that can fire nuclear missiles
Where can I buy Post-It with pre-printed passwords? That would save me so much time.
They had to move his office because there was no room at the inn.
I don't believe in karma, I just call it like I see it.
For no particular reason, at a previous job, I kept a brightly colored Postit stuck to my monitor with a random string written on it. It wasn't the password to anything. And now, for no particular reason, I've shared it with all of you.
Not one of the red and green buttons with the word "test" and "alarm"?
Someone has to use the computer with a pw and select test or alert from a GUI?
A test is selected every shift? Is the alarm so easy to select in the GUI too? Any "Sure?" on the GUI to confirm alarm was selected and not the much used test?
Domestic spying is now "Benign Information Gathering"
how about fixing the Poor UI when you change the password system as well.
https://www.theinquirer.net/in...
A password on a yellow post-it note!! Haven't they ever heard of green or pink or light-blue post-it notes or whatever?!
The password's been changed to "Warmingpoint3" now, so don't bother trying the old one, it won't work.
Oh my god Oh my god Oh my god!!! They managed to get a photo of the secret password that was written on the super-secret Post-It-Note that was secretly affixed on the front of the terminal of our hyper-ultra-secret nuclear-threat-preparedness system! We’re soooooo totally screwed now!
strange game... the only way to win is to not play
That password is for the honeypot...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
n/t
Have gnu, will travel.
I just use correct battery horse staple for everything. That way I don't have to mess around with insecure post-its.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I learned in the Air Force in the seventies that security is impossible to expect from your average American. They just don't get it, no matter how hard you try to explain it to them. Americans are just not afraid of things they should be afraid of, and not suspicious of people and things they should be suspicious of. They don't feel endangered. And it is very hard to make them feel so.
E Proelio Veritas.
When companies force you to change your password every 60 or 90 days "just because" and require the new password to be substantially different than their previous password people start writing them down.
I never understood the thought behind forcing a password change because you've had your password for X days.
I know that a medical company IT staff I know, they go around (due to HIPAA reasons) making sure if people leave their desk they lock the screen on their workstation. He told me more than once, they found post it notes with a password. What they would do is go in and change the password, locking them out, then wait for them to call the help desk. Then they'd get ONE warning not to do it again, or be fired. NO ONE in a corporate world should be allowed to keep a password on a post it note.
I bet it was the Wong password
Yeah the UI is garbage but that doesn't excuse operator error.
Welp, I don't think I will be able to change your mind, but there are at least two schools of thought here, yours:
1. If something bad happens, whip everyone involved until they cannot stand any longer, then fire them, ensuring this never happens again,
Or,
2. Ask why this happened, don't assign blame, then work through the problem to find the root cause, then fix that problem so that it never happens again.
NASA determined that humans fail at pretty much everything about 3% of the time on the ISS and have built in all sorts of checks and balances to account for this. If the ISS blows up, everyone shares the blame, and responsibility for keeping that from happen again. If you assume from the get-go that humans are capable of being 100% infallable 24/7/365, even when they're sleep deprived from a) having a baby b) insomnia from a divorce c) hung over from a bachelors party etc etc then yes your system sounds great as there's no chance anything can ever go wrong and it's just their fault for being a bad person and they should feel bad.
Option 1 is both overly optimistic going in, and highly negative on the resolution side - nobody worth anything will stick around for long; option 2 assumes the worst going in and looks for a positive solution coming out. People tend not to quit out of frustration quite so often in scenario 2.
moox. for a new generation.
I don't know if it's true or not but I heard a story that the only time Harry Houdini couldn't pick a lock to escape from a jail cell was when the deputy didn't actually lock the lock. That story inspired me a long time ago to hang yellow sticky notes on my monitor with what appear to be passwords written on them. Everything from "secret123" to "p455w0rd". I crack me up.
Liberals call everyone Nazis yet they are the closest thing to it.
You're the editor of that newsletter, "How To Be Perfect And Never Make Mistakes", aren't you? May I please subscribe to it?
-=This sig has nothing to do with my comment. Move along now=-
See , removing people making a single error from chain of command or skilled work, means your hierarchy and your worker NEVER learn from their error. The one replacing them will have heard of the error, maybe laugh at it, but most of the time they did not LEARN of it, The one which got burned by it, on the other hand, will remember a long time. Experience is also learning from error. By cutting out people which did error, you are not enhancing your process, hierarchy and worker, on the contrary.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
This is why I keep my passwords in my "password suitcase", where it is encrypted until unlocked for use. (This way I only have to remember a single master password. It's the same numeric 5-digit code as on my other luggage...)
Something you don't have anymore, something you forgot, and something you ate.
Or something like that.
I worked in a place with a security policy that included having somebody from IT walk through the offices looking for this kind of thing (e.g. Post-It notes under keyboards, on cube partitions, etc).
This, in a place that had been a division of another company until a week before my arrival there: so all the legacy systems of the previous corporation plus all the systems of the new corporation, many of them providing the same services.
And password policies like "you must change your password every six months, a password must contain at least one upper case letter, one lower case letter, one digit and one special character" of course, without telling us which special characters were allowed and which were not allowed. Oh, and you couldn't use a password that you had used in the previous 18 months.
So of course, remembering all these passwords was difficult. Some people resorted to Post-It notes, some to noting the passwords in a cellphone or a notebook. A notebook in a locked drawer, of course.
But if a Post-It note with a service name, login name and password was found during the security walk-through, it would be tried out... So guess what happened. People would write down spurious combinations of login name and password. Or write down a service name that didn't exist. The walk-through sometimes took a long time... so trying out the passwords was abandoned; the Post-It notes were simply confiscated and the person whose cube it was would get a new training requirement to follow, yet again, the IT Security Policy training course.
You would think that all three would be required to send out an emergency alert message.
Then in case of an actual emergency (say, when category 9 hurricane 'Zorro' hits Hawai in a couple of months), you'd be complaining that the alert wasn't sent because it relied on a complex validation procedure that required perfectly coordinated simultaneous action by 5 person, one of which was sick on that day, and the other lost his keyfob 12 months ago when his dog ate it.
That's the complex problem with emergency procedures, they need both at the same time be quick enough to execute in case of actual emergency, but have enough confirmation step to not be triggered by incident.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I take it you've never pulled a 'push' door, have you?
What a fucking stupid response. If somebody finds a key for something that I own, my first response would be to change the lock... I certainly hope they have changed the password.
Oh yeah that's totally the same as an emergency alert for an incoming missile attack.
Only the State obtains its revenue by coercion. - Murray Rothbard