Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Worst Password Blunders of 2018 Hit Organizations East and West
Newest First  |  Oldest First  |  Threaded View
MarkSindone
50%
50%
MarkSindone,
User Rank: Moderator
1/9/2019 | 12:15:57 AM
People could get complacent
It is hilarious to learn of password blunders even when we are far off into the 21st century already. People could get really complacent about their digital activities that they decided to be less than concerned about the first tier of security measures which is a good password. The level of vulnerability that they expose themselves to just makes it impossible to lecture them because a high percentage of such users are usually bad at heeding advices.
DavidHamilton
50%
50%
DavidHamilton,
User Rank: Apprentice
1/4/2019 | 2:24:07 AM
Honestly
Honestly, a lot of people don't try hard enough to make sure that their tech devices are properly protected. Unless the system is forcing you to choose a complicated password, seems like all your data in storage is fair game. If you don't value your information and private details, by all means! I personally would want to make sure that I do my utmost to make sure that all my private information isn't too easily accessed!
JasmineJack
50%
50%
JasmineJack,
User Rank: Apprentice
12/19/2018 | 5:54:12 AM
rg
thanks

 
markoer
50%
50%
markoer,
User Rank: Strategist
12/18/2018 | 3:57:10 AM
Nutella is not a company
It is a brand. The company is named Ferrero.  Guys, do your homework :-)

 
MarkSitkowski
50%
50%
MarkSitkowski,
User Rank: Moderator
12/13/2018 | 9:50:28 PM
Is It Really The Password's Fault?
I think this says it all: linkedin.com/pulse/watch-mark-sitkowski/
tdsan
50%
50%
tdsan,
User Rank: Ninja
12/13/2018 | 4:18:28 PM
Interesting article, but I am not so sure the information he provided is correct
I wanted to address some of the statements listed:

→ "Always have a different password for every different service."...and it's impossible to manage them all without technology to help manage the digital identity."

Yes, he is right about that but we don't have to remember passwords for every service. We can integrate the solution with AD/LD and AD Federated services. We can associate 2FA/MFA (as mentioned in the article) as a way to centralize our password management scheme and we can use IdM (Identity Management) tools that will encrypt the data traffic from the source to the destination while the password management solution manages all of the back and forth requests.

→ The first is that 2FA isn't available for many services, he points out.

Most if not all o the providers provide 2FA/MFA, the problem is the consumer does not utilize this service when it is brought to their attention, they bypass the security mechanisms to make things easier. So in retrospect, it is not the vendor but the user who does not utilize the services. I think it would be better if we did not give them a choice but provide different mechanisms of how to enable 2FA/MFA authentication (AWS, Google, F5, MS provide the ability to do just this).

→ "it only costs a few dollars to buy the text messages of an individual," Schalit says."

I am not so sure it is that easy to purchase text messages of individuals, for one, the person has to impersonate that person, they have to know most if not everything about them. Secondly, they have to know which vendor they use (phone company) and third the assailant has to be to know something very specific about the account in order to identify and extract this information. Now if the person on the other end (member of the phone company) was selling this information, then we have bigger problems because now someone on the inside is making it very easy for this information to be obtained. If the phone company has numerous layers of security in place, then it will be only a matter of time to remove and prosecute that person for acting in such a fraudulent manner.

As a side note, I am curious from the conversations of Ed Snowden, are those text messages being sold to the highest bidder from NSA to third-parties. This is not surprising (not to say that they are) since from the time of Bush to now (Obama included) they are still using technology to extract information from the web (US Citizen Surveillance program) to keep an eye on the US public. Hopefully is not easy to get text messages but you never know.

T

Todd


How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3331
PUBLISHED: 2021-01-27
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)
CVE-2021-3326
PUBLISHED: 2021-01-27
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
CVE-2021-22641
PUBLISHED: 2021-01-27
A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
CVE-2021-22653
PUBLISHED: 2021-01-27
Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
CVE-2021-22655
PUBLISHED: 2021-01-27
Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).