Slashdot Mirror
A Photo Accidentally Revealed a Password For Hawaii's Emergency Agency (qz.com)
An anonymous reader quotes a report from Quartz: In the aftermath of an erroneous missile warning that terrified Hawaiians on Saturday (Jan. 13), the state's emergency management agency has come under increased scrutiny, from the poor design of the software that enables alerts to a particularly slapdash security measure by one of its employees. Old photos from the Associated Press inside the agency's office appear to show an unspecified password on a yellow Post-It note, stuck to a computer monitor. The image, which shows operations manger Jeffrey Wong standing in front of the computer, was taken in July and appeared in articles published at the time about the agency's preparedness in the face of a nuclear threat. The agency verified that the password is indeed real but wouldn't go into specifics on what program the password was supposed to be used for.
"yellow Post-It note, stuck to a computer monitor."
Everybody knows real security can only be had by posting it under the keyboard, where nobody can photograph it.
Duh!
What is the point of a password that is out in the open like this? Are passwords that hard to remember?
Actually, yes. When your password must contain upper and lower-case letters, at least one number, a special character, must be at least 12 characters long, must be changed every 3 months, and cannot be a variation of or contain any previous password. That's when you get yellow sticky notes on the monitor.
warningpoint2 also sounds like the system name as well.
Particularly when you have 50 such passwords.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
publishing photographs of the insides emergency management and civil defense facilities isn't such a hot idea either. Information wants to be free.
Are something (fingerprint).
Have something (RFID badge).
Know something (unique-to-user pass phrase).
You would think that all three would be required to send out an emergency alert message.
Put my fist through my alarm clock with its ding-dong death inside my ear. - The Blackjacks.
Particularly when you have 50 such passwords.
And that's when people ask for bigger monitors, to hold all the stick-it notes.
Where can I buy Post-It with pre-printed passwords? That would save me so much time.
So much so that the latest NIST recommendations are that you Should NOT impose composition rules and you Should NOT require the password is changed frequently. It's better to train employees to come up with memorable secure passwords (which don't require hard to remember composition rules https://xkcd.com/936/) and use things like password managers and 2FA.
Once you start requiring them to be 12 characters long, and contain at least one uppercase character, one lowercase character, one numeral, and one Egyptian hieroglyph they are.
By the way, those complexity rules have been officially withdrawn by NIST. In fact, TFA is an instance of the very problem that drove the rule change. Now all we have to do is spend 20 years undoing the damage of the old, stupid, complexity rules.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
And who is to say that a sticky note is that bad? How many passwords are just saved in some plain text file or email?
At least physical access is required to obtain the password, which is probably securely restricted to people you know and trust. Sticky notes are pretty much hacker-proof.
It's even better if you lock your sticky notes in a drawer, to avoid accidents like in TFA.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
The password's been changed to "Warmingpoint3" now, so don't bother trying the old one, it won't work.
The weakest security is always the human involved.
That's true. It's also the reason why password setups and protocols should be made as easy and enjoyable to use as humanly possible.
If you build a password system that's hard to use, hard to remember, and force the user top jump through hoops, you're putting a lot of strain over the weakest link in the system. I.e., you're making the system brittle and easy to hack.
Singularity: a belief in the "God" idea with the "demiurge" relation inverted.
Apparently real and test were two adjacent entries in a drop down list; and then there was a confirmation box "Are you sure?"
Seems like an easy issue to fat-finger, especially if you get the same confirmation box with either selection.
Yesterday I had to make a dash for the printer to cancel a job because "Print" and "Edit" are adjacent in the right click context menu for the windows desktop.
(Really... does anyone really need one-click print without opening the document first, that they even need a right click print context menu item?? I've always wondered about why its there.)
Unfortunately, common sense and authoritative recommendations often succumb to security theater. Like proverbial lemmings. Real quote: "we need to adhere to standards that our customers, the market and other auditory bodies follow."
"National Security is the chief cause of national insecurity." - Celine's First Law
I learned in the Air Force in the seventies that security is impossible to expect from your average American. They just don't get it, no matter how hard you try to explain it to them. Americans are just not afraid of things they should be afraid of, and not suspicious of people and things they should be suspicious of. They don't feel endangered. And it is very hard to make them feel so.
E Proelio Veritas.
When companies force you to change your password every 60 or 90 days "just because" and require the new password to be substantially different than their previous password people start writing them down.
I never understood the thought behind forcing a password change because you've had your password for X days.
And if your system has any type of variation on "can not contain any previous password", it has to store your passwords in plaintext somewhere, which is another huge security issue.
No it doesn't... you can store previous password hashes and when the user attempts to change their password you compare the hash of the new password to the old hashes. No need to store plaintext at all.
Yeah the UI is garbage but that doesn't excuse operator error.
Welp, I don't think I will be able to change your mind, but there are at least two schools of thought here, yours:
1. If something bad happens, whip everyone involved until they cannot stand any longer, then fire them, ensuring this never happens again,
Or,
2. Ask why this happened, don't assign blame, then work through the problem to find the root cause, then fix that problem so that it never happens again.
NASA determined that humans fail at pretty much everything about 3% of the time on the ISS and have built in all sorts of checks and balances to account for this. If the ISS blows up, everyone shares the blame, and responsibility for keeping that from happen again. If you assume from the get-go that humans are capable of being 100% infallable 24/7/365, even when they're sleep deprived from a) having a baby b) insomnia from a divorce c) hung over from a bachelors party etc etc then yes your system sounds great as there's no chance anything can ever go wrong and it's just their fault for being a bad person and they should feel bad.
Option 1 is both overly optimistic going in, and highly negative on the resolution side - nobody worth anything will stick around for long; option 2 assumes the worst going in and looks for a positive solution coming out. People tend not to quit out of frustration quite so often in scenario 2.
moox. for a new generation.
3 months? Once had a place where it had to be done weekly. And obviously people have to have one for every website. Often with logins tha are different as well.
And no, a password manager can not be used everywhere.
Password policy is basically blameshifting to the enduser.
Don't fight for your country, if your country does not fight for you.
You would think that all three would be required to send out an emergency alert message.
Then in case of an actual emergency (say, when category 9 hurricane 'Zorro' hits Hawai in a couple of months), you'd be complaining that the alert wasn't sent because it relied on a complex validation procedure that required perfectly coordinated simultaneous action by 5 person, one of which was sick on that day, and the other lost his keyfob 12 months ago when his dog ate it.
That's the complex problem with emergency procedures, they need both at the same time be quick enough to execute in case of actual emergency, but have enough confirmation step to not be triggered by incident.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I take it you've never pulled a 'push' door, have you?