[cheyenne 09]

Interesting Article on Computer Passwords Reveal Workers Secrets

What do you all think of this Surely People Cannot be this Dumb

Link Technology News
http://news.zdnet.co..._22-530187.html

[Advertisements]

Yes they can.

When I was working as tech support for an ISP, I'd need to setup e-mail accounts for 100's of people, mostly in business. Sometimes they would give me usernames and passwords sometimes just usernames and a "default" password.

Once the account was created I'd send a test e-mail to each account to make sure it worked. If the company used default passwords I'd include instructions on changing the password in the test e-mail.

I saw a LOT of passwords this way. Many use the username as the password and most people used BAD passwords (like "hummer" for 3 people I knew that drove one).

When I got support calls for e-mail issues most users whose company used the default password never had changed it.

I had a hard time trying to convince them they should change it. They would also tell me things like "but I like this password and use it for everything". The ones that scared me were the ones who told me "I like using my fist name and my pin number as a password". YES! They said PIN number as in ATM pin number. They didn't always use their first name but I'd guess 1 in 4 that used alpha and numeric characters used their PIN number for the number part, for security reasons I'm sure.

If I had been a criminal type.... or if a criminal type ever gets a hold of their password these people have all their password the same and their PIN numbers the same for any account they have... e-mail, computer, Bank, etc....

Edited by bobmad, 02 May 2007 - 09:02 AM.

[bobmad]

Yes they can.

When I was working as tech support for an ISP, I'd need to setup e-mail accounts for 100's of people, mostly in business. Sometimes they would give me usernames and passwords sometimes just usernames and a "default" password.

Once the account was created I'd send a test e-mail to each account to make sure it worked. If the company used default passwords I'd include instructions on changing the password in the test e-mail.

I saw a LOT of passwords this way. Many use the username as the password and most people used BAD passwords (like "hummer" for 3 people I knew that drove one).

When I got support calls for e-mail issues most users whose company used the default password never had changed it.

I had a hard time trying to convince them they should change it. They would also tell me things like "but I like this password and use it for everything". The ones that scared me were the ones who told me "I like using my fist name and my pin number as a password". YES! They said PIN number as in ATM pin number. They didn't always use their first name but I'd guess 1 in 4 that used alpha and numeric characters used their PIN number for the number part, for security reasons I'm sure.

If I had been a criminal type.... or if a criminal type ever gets a hold of their password these people have all their password the same and their PIN numbers the same for any account they have... e-mail, computer, Bank, etc....

Edited by bobmad, 02 May 2007 - 09:02 AM.

[dsenette]

the point of a password is to offer security for the underlying system....but the people using the passwords are HUMANS so by nature they take the easy route...no one wants a password that they can't remember off hand...or username...so they choose something that they'll always remember (like their birthday or something) and never change it....then they wonder why their bank account info get's stolen

i've known a few companies who's IS departments have instated the absolutely most severe password policies i've ever seen....the usernames are numerical (tied in to the user's employee number or some other identifier) with 16 character alphanumeric (and special characters) randomly generated passwords that change every 30 days...that's some severe stuff.....

when you go too far into either extreme you basically have the exact same problem...if the password is too easy to crack...then it's not secure...but if the password is so hard to remember that the user has to write it down on a sticky note...then it's just as bad


the standard rule of thumb is to make sure your password is alphanumeric (letters and numbers...if special characters are allowed..then adding those in are better) at the very least...and that it's something that you can remember but isn't actually related to you at all (such as a birthday or your name or car)....a word that you're fond of with numbers mixed in is a good option... i love the word abscond...don't know why but i do....so a good variation of that would be 4bSc0Nd as a mixture of caps and lower case is good as well