Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Worst Password Blunders of 2018 Hit Organizations East and West
Newest First  |  Oldest First  |  Threaded View
MarkSindone
MarkSindone,
User Rank: Moderator
1/9/2019 | 12:15:57 AM
People could get complacent
It is hilarious to learn of password blunders even when we are far off into the 21st century already. People could get really complacent about their digital activities that they decided to be less than concerned about the first tier of security measures which is a good password. The level of vulnerability that they expose themselves to just makes it impossible to lecture them because a high percentage of such users are usually bad at heeding advices.
DavidHamilton
DavidHamilton,
User Rank: Apprentice
1/4/2019 | 2:24:07 AM
Honestly
Honestly, a lot of people don't try hard enough to make sure that their tech devices are properly protected. Unless the system is forcing you to choose a complicated password, seems like all your data in storage is fair game. If you don't value your information and private details, by all means! I personally would want to make sure that I do my utmost to make sure that all my private information isn't too easily accessed!
JasmineJack
JasmineJack,
User Rank: Apprentice
12/19/2018 | 5:54:12 AM
rg
thanks

 
markoer
markoer,
User Rank: Strategist
12/18/2018 | 3:57:10 AM
Nutella is not a company
It is a brand. The company is named Ferrero.  Guys, do your homework :-)

 
MarkSitkowski
MarkSitkowski,
User Rank: Moderator
12/13/2018 | 9:50:28 PM
Is It Really The Password's Fault?
I think this says it all: linkedin.com/pulse/watch-mark-sitkowski/
tdsan
tdsan,
User Rank: Ninja
12/13/2018 | 4:18:28 PM
Interesting article, but I am not so sure the information he provided is correct
I wanted to address some of the statements listed:

→ "Always have a different password for every different service."...and it's impossible to manage them all without technology to help manage the digital identity."

Yes, he is right about that but we don't have to remember passwords for every service. We can integrate the solution with AD/LD and AD Federated services. We can associate 2FA/MFA (as mentioned in the article) as a way to centralize our password management scheme and we can use IdM (Identity Management) tools that will encrypt the data traffic from the source to the destination while the password management solution manages all of the back and forth requests.

→ The first is that 2FA isn't available for many services, he points out.

Most if not all o the providers provide 2FA/MFA, the problem is the consumer does not utilize this service when it is brought to their attention, they bypass the security mechanisms to make things easier. So in retrospect, it is not the vendor but the user who does not utilize the services. I think it would be better if we did not give them a choice but provide different mechanisms of how to enable 2FA/MFA authentication (AWS, Google, F5, MS provide the ability to do just this).

→ "it only costs a few dollars to buy the text messages of an individual," Schalit says."

I am not so sure it is that easy to purchase text messages of individuals, for one, the person has to impersonate that person, they have to know most if not everything about them. Secondly, they have to know which vendor they use (phone company) and third the assailant has to be to know something very specific about the account in order to identify and extract this information. Now if the person on the other end (member of the phone company) was selling this information, then we have bigger problems because now someone on the inside is making it very easy for this information to be obtained. If the phone company has numerous layers of security in place, then it will be only a matter of time to remove and prosecute that person for acting in such a fraudulent manner.

As a side note, I am curious from the conversations of Ed Snowden, are those text messages being sold to the highest bidder from NSA to third-parties. This is not surprising (not to say that they are) since from the time of Bush to now (Obama included) they are still using technology to extract information from the web (US Citizen Surveillance program) to keep an eye on the US public. Hopefully is not easy to get text messages but you never know.

T

Todd


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Incorporating a Prevention Mindset into Threat Detection and Response
Threat detection and response systems, by definition, are reactive because they have to wait for damage to be done before finding the attack. With a prevention-mindset, security teams can proactively anticipate the attacker's next move, rather than reacting to specific threats or trying to detect the latest techniques in real-time. The report covers areas enterprises should focus on: What positive response looks like. Improving security hygiene. Combining preventive actions with red team efforts.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-25878
PUBLISHED: 2022-05-27
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption ...
CVE-2021-27780
PUBLISHED: 2022-05-27
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
CVE-2021-27781
PUBLISHED: 2022-05-27
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
CVE-2022-1897
PUBLISHED: 2022-05-27
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-20666
PUBLISHED: 2022-05-27
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient va...