Endpoint //

Privacy

Worst Password Blunders of 2018 Hit Organizations East and West

Good password practices remain elusive as Dashlane's latest list of the worst password blunders can attest.

When it comes to security, there are many things humans do badly. A new end-of-the-year list provides a new batch of evidence that passwords are among the worst.

The "Worst Password Offenders of 2018," assembled by password management vendor Dashlane, goes from the ridiculous to the horrifying.

The No. 1 offender on the list is the former, Kanye West, who shared his password — 000000 — on television as he unlocked his iPhone to show the screen to President Trump during an Oval Office meeting.

The remainder of the top 10 offenders lean heavily toward government or quasi-government agencies, with the second offender one of the most worrying: the Pentagon. A Government Accountability Office (GAO) audit found that many system admin passwords could be guessed in as few as nine seconds, and " ... software for multiple weapons systems was protected by default passwords," according to Dashlane. Those passwords, the GAO noted, could be found by anyone with a knowledge of the systems' manufacturers and a working understanding of how Google works.

"Unfortunately, changing the default password wouldn't make a huge difference," says Emmanuel Schalit, CEO of Dashlane. He notes that the most significant issue is a limitation of the human brain. "The most important thing you can do as an individual is to never reuse passwords," he says. "Always have a different password for every different service."

That reuse becomes challenging, Schalit explains, because "the average consumer has 200 passwords, and it's impossible to manage them all without technology to help manage the digital identity."

Other offenders on the list include Cambridge University, for exposing records of thousands of experimental subjects because a password was left in a Github repository, and Nutella, for suggesting that its Twitter followers use the word "Nutella" as their passwords as a "helpful" suggestion on National Password Day.

Some have promoted the use of two-factor authentication (2FA) as a way to reduce the impact of poor password hygiene. Schalit, too, says two factors should be used wherever possible, though its overall effectiveness is limited by two major factors. The first is that 2FA isn't available for many services, he points out.

Second, even where it is available, 2FA frequently uses SMS as part of the second factor, and " ... it only costs a few dollars to buy the text messages of an individual," Schalit says.

It's important that individuals work to improve their digital practices, he adds, because the issues with secure digital identities go beyond personal finance. "It's not an individual issue anymore — it's a global issue," he says. "Whenever one of us is breached or compromised, that doesn't just impact the individual. It starts to erode the very fabric of the Internet when it becomes too dangerous, too risky."

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MarkSindone
50%
50%
MarkSindone,
User Rank: Apprentice
1/9/2019 | 12:15:57 AM
People could get complacent
It is hilarious to learn of password blunders even when we are far off into the 21st century already. People could get really complacent about their digital activities that they decided to be less than concerned about the first tier of security measures which is a good password. The level of vulnerability that they expose themselves to just makes it impossible to lecture them because a high percentage of such users are usually bad at heeding advices.
DavidHamilton
50%
50%
DavidHamilton,
User Rank: Apprentice
1/4/2019 | 2:24:07 AM
Honestly
Honestly, a lot of people don't try hard enough to make sure that their tech devices are properly protected. Unless the system is forcing you to choose a complicated password, seems like all your data in storage is fair game. If you don't value your information and private details, by all means! I personally would want to make sure that I do my utmost to make sure that all my private information isn't too easily accessed!
JasmineJack
50%
50%
JasmineJack,
User Rank: Apprentice
12/19/2018 | 5:54:12 AM
rg
thanks

 
markoer
50%
50%
markoer,
User Rank: Apprentice
12/18/2018 | 3:57:10 AM
Nutella is not a company
It is a brand. The company is named Ferrero.  Guys, do your homework :-)

 
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
12/13/2018 | 9:50:28 PM
Is It Really The Password's Fault?
I think this says it all: linkedin.com/pulse/watch-mark-sitkowski/
tdsan
50%
50%
tdsan,
User Rank: Strategist
12/13/2018 | 4:18:28 PM
Interesting article, but I am not so sure the information he provided is correct
I wanted to address some of the statements listed:

→ "Always have a different password for every different service."...and it's impossible to manage them all without technology to help manage the digital identity."

Yes, he is right about that but we don't have to remember passwords for every service. We can integrate the solution with AD/LD and AD Federated services. We can associate 2FA/MFA (as mentioned in the article) as a way to centralize our password management scheme and we can use IdM (Identity Management) tools that will encrypt the data traffic from the source to the destination while the password management solution manages all of the back and forth requests.

→ The first is that 2FA isn't available for many services, he points out.

Most if not all o the providers provide 2FA/MFA, the problem is the consumer does not utilize this service when it is brought to their attention, they bypass the security mechanisms to make things easier. So in retrospect, it is not the vendor but the user who does not utilize the services. I think it would be better if we did not give them a choice but provide different mechanisms of how to enable 2FA/MFA authentication (AWS, Google, F5, MS provide the ability to do just this).

→ "it only costs a few dollars to buy the text messages of an individual," Schalit says."

I am not so sure it is that easy to purchase text messages of individuals, for one, the person has to impersonate that person, they have to know most if not everything about them. Secondly, they have to know which vendor they use (phone company) and third the assailant has to be to know something very specific about the account in order to identify and extract this information. Now if the person on the other end (member of the phone company) was selling this information, then we have bigger problems because now someone on the inside is making it very easy for this information to be obtained. If the phone company has numerous layers of security in place, then it will be only a matter of time to remove and prosecute that person for acting in such a fraudulent manner.

As a side note, I am curious from the conversations of Ed Snowden, are those text messages being sold to the highest bidder from NSA to third-parties. This is not surprising (not to say that they are) since from the time of Bush to now (Obama included) they are still using technology to extract information from the web (US Citizen Surveillance program) to keep an eye on the US public. Hopefully is not easy to get text messages but you never know.

T

Todd
neiljakson105
0%
100%
neiljakson105,
User Rank: Guru
12/13/2018 | 6:21:51 AM
nice post
The information you have provided is very helpful at all thank you very much for sharing useful information with us.   coursework writing service uk
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.