Source
r/sysadmin•
veswdev

No, that's not a good password.

Rant

I spent last week looking at security of passwords and found users circumventing the requirements. These are some of the developers with DB access, let's begin with the core developers:

Superadmin (access to prod dbs) now changed passwords: dbadmin, dbms, admin, p4sswordfordb

Web Passwords (old now) : web ecomadmin store Hi123

And finally... We arrive. Old LDAP passwords: Fuckyou123 Fuckthisshit1235 ldap password32141 Smith215 windows10

How the fuck did these people circumvent the policy? Oh I'll tell you how! The old sysadmin gave His fucking credentials to everyone because he was "too busy" to reset passwords. (spoiler: was fired for not doing anytbing to help anyone)

Fuck sakes. Why just fucking why.

Posted Jul 15, 2019, 11:55 PM UTC

4672
disclosure5•

Fuckthisshit1235

Upper case, lower case, numeric. This smells of "password composition requirements policy", and users being trained in exactly the way you'd expect to deal with it.

44
TenGigabitEthernet•

Also 16 characters. I'd say this is a pretty decent password compared to the usual (like "qwerty" or "12345")

17
Ashmedai•

At a guess it only failed to work due to "fuckthisshit" probably be treated as a discrete word in a brute force attack database (or some variation). Dumbhorsetail1235 would probably be uncrackable in comparison.

3
XANi_Senior Cat Herder•

Well, at least according to https://haveibeenpwned.com your guess is spot-on

3
deepleedooo•

Password complexity requirements: yeah, fuck that shit

11
ImCaffeinated_Chris•

Passwordcomplexityrequirementsyeah

Would actually be a good password :)

5
Specialist_Chemistry•

Passwordcomplexityrequirementsyeah

Passwordcomplexityrequirementsyeah1!

3
zmbie_killer•

Doesn't anyone add spaces to their passwords?

1
ImCaffeinated_Chris•

I'm from the DOS generation. Spaces give me hives.

2
deepleedooo•

My bank limits password's max length to 16 characters. So no budget for spaces.

1
FlameChungus•

I reset one of my passwords whilst doing an internal demo the other day. It said Password1 was a strong password...

3
starmizzleS-1-5-420-512•

It has 3 of the 4 character categories though.

3
FlameChungus•

It does but it shows both how arbitrary they are how misleading they can be to end users.

2
ABotelho23•

Honestly, you shouldn't be posting old passwords on the internet.

I'm also curious at to how exactly these passwords were being stored..

33
veswdevOP•

It was stored encrypted, but simple cracker was able to find it.

14
sobrique•

Careful. Here be dragons. It is potentially computer misuse (and therefore illegal) to crack passwords. Depends a bit where you live, and how arsey the company is, but it can be a real can of worms you do not want to open.

7
Local_admin_user•

Realistically depends on his post and any pre-password bashing authorisation he has. I'm allowed to do it as/when I want but I still notify my boss the day before I do anything to give them time to tell me not to. It does upset people when they find out you've done it, but if there are poor passwords in use then it's best to find them and educate the users than leaving them. Likewise it can drive policy in a way which helps users e.g. proves poor use due to complexity/expiry requirements.

2
sobrique•

Yeah, sure. It's not a hard "no" but it's definitely a place for plenty of CYA.

1
Zenkin•

I would be concerned that any malicious activity from this point forward can be blamed on the administrators because "They know all of our passwords." Who cares if Susie's account was used to delete important files when we know there are multiple people that could have done it?

1
adhdasf23423•

Honestly, you shouldn't expose your living location in your previous comments.

7
ABotelho23•

I'm interesting interested in how far back you had to look, cause that's honestly kind of weird.

5
adhdasf23423•

I'm interesting

No you're not. Haha, but no I didn't check your history. I was just saying, like you were just saying. I saw your useless comment and I had to follow suit.

6
ABotelho23•

You understand that plenty of services use old passwords for the purpose of recovery right?

​

These people may also be using some of these passwords for other services as well. It's irresponsible to post old passwords, no matter how garbage they are.

2†
fatDaddy21•

Fuckthatshit1235

1
AjahnMara•

one of my users uses hisname12345 as a password. He says its super secure cause people only guess hisname123 and hisname123456 - NOBODY HAS ONLY 5 is what he told me.

Later in the same call I struggle using this password and getting the correct amount of numbers and he's like TOLD YOU SO

14
XANi_Senior Cat Herder•

Should use hisname12354, nobody have a chance /s

1
Panacea4316IT Manager•

Good Lord. Thats almost as bad as Companyname123! as our firewall password -_-

10
TiminAurora•

Wait how'd you guess my password?

16
Oh_for_fuck_sakes•

All i see is ****** ?

10
-J-P-•

let me try with our firewall password:

hunter2

3
SecretEconomist•

Sighh

might want to star that out, I see hunter2

1
Panacea4316IT Manager•

I have the same password on my luggage.

8
FireLucid•

Our CEO has just his first name as his password many years ago. Yeah, I started work on GPO's when I started.

5
reconlabtech•

Had a CFO that demanded his password not be changed and limited to 4 characters. The sooner we replace password authentication the better.

2
HappyCakeDayisCringe•

Saw a user last week type their password into username.

Summer2019!

Fucking El oh El

2
Zenkin•

A few jobs ago I was asking a coworker why he did some such thing, and he just told me "Hey, you can just log in as me to fix it. My password is Welcome13."

I was frozen in thought for a few seconds because, first of all, I did not want his password. And then I responded "Hey ....did you start here in $PreviousMonth of last year?"

"Uh, yeah. How did you know?"

4
Panacea4316IT Manager•

A C-level at an old client had the same style password except no exclamation point.

2
HappyCakeDayisCringe•

Honestly it was probably just Summer2019. Im just giving them the benefit of the doubt, lol.

1
AtarukA•

We got that for email for some of my clients. Gets very funny when every week (almost), they got pirated mailboxes.

1
Panacea4316IT Manager•

The guy I replaced who had a MCSE and CCNA thought that was a "secure" password. One of the many reasons he only lasted 5 weeks lol.

2
[deleted]•

[deleted]

1
[deleted]•

what about hunter2?

10
kennedye2112Oh I'm bein' followed by an /etc/shadow•

What about what? All I see are asterisks.

12
[deleted]•

Whew. Looks like my password protection is working then. :)

4
CelestrusJack of All Trades•

Hey that sound good

1
BoredTechyGuy•

The real question:

#Why does the password for an old FIRED admin still work which allows this stupidity to continue?

edit: Spelling

8
AdministrativeMap9Knows Enough To Get In Trouble•

That is pretty bad. Here's examples similar to what I use:

"O99&0=w}Ud_?ERFI9

zF(\=b(M2-g"y>!#--

rHbRH\([Q~!Oa{<&Fm8A

5
veswdevOP•

I always recommend people use the password manager we have in place, hit that little "generate" button... but apparently it's "too complex to remember" -- despite the fact they can open their browser at any time and retrieve it....

4
purplemonkeymad•

I got my boss to start using more random passwords by writing a little generator for him. It had to be open and get a password(s). Can't fiddle unlocking your vault or having to choose complexity before you go. You want to make it super easy to get a good memorable password, otherwise it will just be easier to use a bad one.

Also had to be easy to copy and paste.

2
dwarftosser77•

Those are the kind of combinations an idiot would have on his luggage.

5
Doso777•

Test123 is a valid root password. Yep.

3
The-Dark-Jedi•

Teach people passphrases and you will get better compliance out of them. Ex:

  • I 8 eggs 4 breakfast.
  • I love my 2 kids!
  • Should I be looking 4 a new job?

I taught this at my last job and passphrase compliance went through the roof.

3
fuzzypeter•

I keep my passwords under 4 characters, the "hackers" will never think anyone is that stupid and starts their bruteforcing at 6.

3
sec_admin•

Ever since i saw the xkcd comic on password, I’ve been happily compliant on passwords.

2
erskinetech2•

I have our MD's wife (for one of the 18 companies I work with so good luck) and their password is there name 3 char no upper case she runs payroll/HR

2
D1TACJr. Sysadmin•

They must really hate passwords.. It's ok I came into this company and there passwords are literally bogus. They always do a animal-day/item-date-special character.. which I mean does work but still..

2
nullZr0•

Previous Sys Admin: "We need some sort of self-service password system. Here's what I found and here are three quotes."

Management: "Fuck off."

Previous Sys Admin: "Fuck it."

2
FuzzmiesterJack of All Trades•

How did you find out what the passwords were?

1
veswdevOP•

Straight brute force of the hash

1
[deleted]•

[deleted]

1
Sketch_Bug•

You've got the passwords in plain text now, so I'm not sure it mattered what they were. Maybe salt and hash those next time.

1
Ashmedai•

He cracked them, tho.

4
TitelSin•

It's funny when you have different(non-standard) keyboard layouts, and you think you type somehting and then it sticks because it's that wierd. Dvorak people have the advantage here.

1
[deleted]•

[deleted]

0
XANi_Senior Cat Herder•

actually those passwords arent that bad from an entropy standpoint.

Just because RNG generated perfectly random string of "11111111" doesn't mean it is a good password

1
[deleted]•

[deleted]

1
[deleted]•

[deleted]

1