Endpoint //

Privacy

Worst Password Blunders of 2018 Hit Organizations East and West

Good password practices remain elusive as Dashlane's latest list of the worst password blunders can attest.

When it comes to security, there are many things humans do badly. A new end-of-the-year list provides a new batch of evidence that passwords are among the worst.

The "Worst Password Offenders of 2018," assembled by password management vendor Dashlane, goes from the ridiculous to the horrifying.

The No. 1 offender on the list is the former, Kanye West, who shared his password — 000000 — on television as he unlocked his iPhone to show the screen to President Trump during an Oval Office meeting.

The remainder of the top 10 offenders lean heavily toward government or quasi-government agencies, with the second offender one of the most worrying: the Pentagon. A Government Accountability Office (GAO) audit found that many system admin passwords could be guessed in as few as nine seconds, and " ... software for multiple weapons systems was protected by default passwords," according to Dashlane. Those passwords, the GAO noted, could be found by anyone with a knowledge of the systems' manufacturers and a working understanding of how Google works.

"Unfortunately, changing the default password wouldn't make a huge difference," says Emmanuel Schalit, CEO of Dashlane. He notes that the most significant issue is a limitation of the human brain. "The most important thing you can do as an individual is to never reuse passwords," he says. "Always have a different password for every different service."

That reuse becomes challenging, Schalit explains, because "the average consumer has 200 passwords, and it's impossible to manage them all without technology to help manage the digital identity."

Other offenders on the list include Cambridge University, for exposing records of thousands of experimental subjects because a password was left in a Github repository, and Nutella, for suggesting that its Twitter followers use the word "Nutella" as their passwords as a "helpful" suggestion on National Password Day.

Some have promoted the use of two-factor authentication (2FA) as a way to reduce the impact of poor password hygiene. Schalit, too, says two factors should be used wherever possible, though its overall effectiveness is limited by two major factors. The first is that 2FA isn't available for many services, he points out.

Second, even where it is available, 2FA frequently uses SMS as part of the second factor, and " ... it only costs a few dollars to buy the text messages of an individual," Schalit says.

It's important that individuals work to improve their digital practices, he adds, because the issues with secure digital identities go beyond personal finance. "It's not an individual issue anymore — it's a global issue," he says. "Whenever one of us is breached or compromised, that doesn't just impact the individual. It starts to erode the very fabric of the Internet when it becomes too dangerous, too risky."

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MarkSindone
50%
50%
MarkSindone,
User Rank: Apprentice
1/9/2019 | 12:15:57 AM
People could get complacent
It is hilarious to learn of password blunders even when we are far off into the 21st century already. People could get really complacent about their digital activities that they decided to be less than concerned about the first tier of security measures which is a good password. The level of vulnerability that they expose themselves to just makes it impossible to lecture them because a high percentage of such users are usually bad at heeding advices.
DavidHamilton
50%
50%
DavidHamilton,
User Rank: Apprentice
1/4/2019 | 2:24:07 AM
Honestly
Honestly, a lot of people don't try hard enough to make sure that their tech devices are properly protected. Unless the system is forcing you to choose a complicated password, seems like all your data in storage is fair game. If you don't value your information and private details, by all means! I personally would want to make sure that I do my utmost to make sure that all my private information isn't too easily accessed!
JasmineJack
50%
50%
JasmineJack,
User Rank: Apprentice
12/19/2018 | 5:54:12 AM
rg
thanks

 
markoer
50%
50%
markoer,
User Rank: Apprentice
12/18/2018 | 3:57:10 AM
Nutella is not a company
It is a brand. The company is named Ferrero.  Guys, do your homework :-)

 
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
12/13/2018 | 9:50:28 PM
Is It Really The Password's Fault?
I think this says it all: linkedin.com/pulse/watch-mark-sitkowski/
tdsan
50%
50%
tdsan,
User Rank: Strategist
12/13/2018 | 4:18:28 PM
Interesting article, but I am not so sure the information he provided is correct
I wanted to address some of the statements listed:

→ "Always have a different password for every different service."...and it's impossible to manage them all without technology to help manage the digital identity."

Yes, he is right about that but we don't have to remember passwords for every service. We can integrate the solution with AD/LD and AD Federated services. We can associate 2FA/MFA (as mentioned in the article) as a way to centralize our password management scheme and we can use IdM (Identity Management) tools that will encrypt the data traffic from the source to the destination while the password management solution manages all of the back and forth requests.

→ The first is that 2FA isn't available for many services, he points out.

Most if not all o the providers provide 2FA/MFA, the problem is the consumer does not utilize this service when it is brought to their attention, they bypass the security mechanisms to make things easier. So in retrospect, it is not the vendor but the user who does not utilize the services. I think it would be better if we did not give them a choice but provide different mechanisms of how to enable 2FA/MFA authentication (AWS, Google, F5, MS provide the ability to do just this).

→ "it only costs a few dollars to buy the text messages of an individual," Schalit says."

I am not so sure it is that easy to purchase text messages of individuals, for one, the person has to impersonate that person, they have to know most if not everything about them. Secondly, they have to know which vendor they use (phone company) and third the assailant has to be to know something very specific about the account in order to identify and extract this information. Now if the person on the other end (member of the phone company) was selling this information, then we have bigger problems because now someone on the inside is making it very easy for this information to be obtained. If the phone company has numerous layers of security in place, then it will be only a matter of time to remove and prosecute that person for acting in such a fraudulent manner.

As a side note, I am curious from the conversations of Ed Snowden, are those text messages being sold to the highest bidder from NSA to third-parties. This is not surprising (not to say that they are) since from the time of Bush to now (Obama included) they are still using technology to extract information from the web (US Citizen Surveillance program) to keep an eye on the US public. Hopefully is not easy to get text messages but you never know.

T

Todd
neiljakson105
0%
100%
neiljakson105,
User Rank: Guru
12/13/2018 | 6:21:51 AM
nice post
The information you have provided is very helpful at all thank you very much for sharing useful information with us.   coursework writing service uk
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6455
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a double-free problem in the function rec_mset_elem_destroy() in the file rec-mset.c.
CVE-2019-6456
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_fex_size() in the file rec-fex.c of librec.a.
CVE-2019-6457
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_aggregate_reg_new in rec-aggregate.c in librec.a.
CVE-2019-6458
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_buf_new in rec-buf.c when called from rec_parse_rset in rec-parser.c in librec.a.
CVE-2019-6459
PUBLISHED: 2019-01-16
An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_extract_type in rec-utils.c in librec.a.