Friend: "No need to hash the passwords. It's a waste of time."

Later that day...
Me: "I always suspected you had a thing for Rose."

Friend: "What, where did you hear that ?"

Me: "I hacked into your MySQL database. Your password is 'il0verose'."

Friend: "How do I hash passwords again ?"

When a website uses https but stores passwords in plain text...

My school.

We have free WiFi access, but you need to login into your personal student account to use it.

Turns out, SQL Injection works.
It gets worse.
Table name "schueler".
SELECT *
Well.
Got all data on all students.
Name, address, phone number, passwords in plain.

I reported it using an anonymous email. Partially fixed. Standard quotes now get eacaped. Still, passwords are now MD5.

Me Visiting a new location...

*Device found a new wi-fi signal:
worldsMostSecureRouter

*Enter password:
worldsMostSecureRouter123

*Authorizing...
*Obtaining IP address
*Connected

My LastPass master password..

Using Base64 "encryption" to store credit card numbers and passwords

Everybody complains about SHA-1.
I'm so glad that I store passwords in plain text.

;-)

Creating a new account is always fun...

"This Is My Secure Password" <-- Sorry, no spaces allowed.

"ThisIsMySecurePassword" <-- Sorry, Passwords must include a number

"ThisIsMySecurePassword1" <-- Sorry, Passwords must include a special character

"ThisIsMySecurePassword 1" <-- Sorry, no spaces allowed

"ThisIsMySecurePassword%1" <-- Sorry, the % character is not allowed

"ThisIsMySecurePassword_1" <-- Sorry, passwords must be shorter than 16 characters

"Fuck" <-- Sorry, passwords must longer than 6 characters

"Fuck_it" <-- Sorry, passwords can't contain bad language

"Password_1" <-- Accepted.

What is this?

Omg...
T-Mobile AT was asked, why they store passwords in plain text, and in a long discussion, they answered this (see img)

I don't know, if this is a late april fool...

Are you serious? Are you afraid of an SQL injection or something, and instead of properly sanitizing your queries you disallow characters? Or is your software and database so outdated that you're afraid special characters will break it? Goodbye security

Hope it's not a repost but this is brilliant... although putting it up in my office wouldnt change anything. Password123 was there before me and it'll be there after me.

"I really love the new $3k Fortigate firewall switch you bought for the office after our chat about security but it doesn't change the fact that you can access any computer in the company using Password123" - me

I typed "WordPress_&_Wix" in the password field.

The page said "Password is too weak".

What the actual fuck? Person (or people!) who devised this password policy, you are an idiot (or idiots - all of you). You are stupid and insane and have no idea about security or user experience.

I encrypt passwords with Base64

Do you salt passwords? Yes...
Ladys and Gentlemen my father

"We should just store the passwords in plain text"

What Could Possibly Go Wrong? 😂😂

I DON'T CHANGE PASSWORDS ANYMORE! CREATE A NEW ACCOUNT FOR ALL I CARE OR GO FUCK YOURSELF AND CLIMB A MOUNTAIN OF DICKS MOUTH FIRST!

Me: *enters password on phone (long PIN)*
Person next to me is looking at my phone WHILE I enter my password, and as I look at him, he doesn't even turn away and even has the nerve to say:
"Wow, why do you have such a long password!"
Μy answer: "Because of security reasons."
What I actually wanted to say:
"Because of pieces of SHIT like you who can't keep their eyes to themselves, even when PASSWORDS are involved, you FUCK! Guess why everytime I enter a password in public, I have to dim my screen and turn my screen sideways? Because of fuckheads like you, not knowing shit about privacy and security! Fuck you!"

PM: We need security on signup, the password entry should contain "A capital letter, 2 numbers, a symbol, an inspiring message, a spell, a gang sign, a hieroglyph and the blood of a virgin."
ME:

Mistyping one character wrong in a password and hitting backspace until I am sure I’ve deleted the entire Wikipedia.

Then starting all over again.

Way to many...

- Passwords stored in plain text on the year 2014
- Not supporting HTTPS because to expensive
- Hidden admin URLS
- Databases available all over the internet
- Client Side validation
- IoT

Guy: I don't trust password managers
Me: so how do you remember passwords?
Guy: oh, I just keep them in a note in the iPhone notes app/iCloud.

I like my fries how I like my passwords... salted :)

Just went skydiving. Realized I probably should have left behind all my clients' site admin passwords in case my chute didn't open. Turns out I'm still alive so no harm done.

My bio professor has a word doc called passwords that she keeps on an unencrypted external hard drive.

She leaves the hard drive in the room with all of her other stuff when she goes for a break between classes.

My dad believes in hiding his passwords in plain sight

He puts them all in a
readme.txt sitting next to the Canon printer exe file. 😂

'Incorrect password.'

"I must've forgotten the password. Let me change it".

'Old and new passwords cannot be same'

o_O

Writing customer passwords fulltext into the prod database because "it's easier to associate them with the user"

!rant

IDE or text editors ?
I tbh use notepad++ to work on text files and encrypted files for passwords lol

For april fools i added a code that reverses the user input password
and wrote " due to a bug occurred in our database all user passwords have been inverted. Our developers are working on this issue "

Unique & Secure Passwords...
Source: Hacking FB Page

Today FileZilla saved my life by storing all site connection passwords in base64
Without it we'd have lost access to an old production server 👌

This cuts deep

Gets email from work

"New password policy introduced from next month

Passwords will have to include:
- a capital
- a lower case
- a number
- a symbol
- be at least 8 characters

Passwords will be be changed every 60 days with a new password not previously used"

Everyone starts moaning, there I am laughing as I'm in Linux and off their domain controller, and my windows laptop is a BYOD laptop and they don't want it on the domain :D

Unique Passwords..😂

THERE IS NOTHING AS FRUSTRATING AS WAITING FOR A RESET PASSWORD MAIL... ONLY TO GET A STREAM OF 16 PLAINTEXT PASSWORDS 30 MINUTES LATER, WITH NONE OF THEM WORKING.

Fuck you, IKEA. 🖕

Lately, Namecheap has been forcing their users to change passwords once every six months. Otherwise, they bombard you with annoying popups. When I finally changed mine, this is how they did it on their end. I just can't deal with the irony of this whole situation...

!!pointless story

Bug report comes in from a coworker. "Cloudinary uploads aren't working. I can't sign up new customers."

"I'll look into it" I say.

I go to one of our sites, and lo! No Cloudinary image loads. Well that can't be good.

I check out mobile app -- our only customer-facing platform. None of the images load! Multiple "Oops!" snackbars from 500 errors on every screen / after every action.

"None of our Cloudinary images load, even in the mobile app," I report.

Nobody seems to notice, but they're probably busy.

I go to log into the Cloudinary site, and realize I don't have the credentials.

"What are the Cloudinary credentials, @ceo?" I ask.

I'm met with more silence. I use this opportunity to look through the logs, try different URLs/transforms directly. Oddly, everything seems fine except on our site.

I check Slack again, and see nothing's changed, so I set about trying to guess the credentials.

Let's see... the ceo is basically illiterate when it come to tech, so it's probably not his email. It's a startup, and custom emails for things cost money, and haven't been a thing here forever, so it's probably oen of the CTO's email aliases. he likes dots and full names so that narrows it down. Now for the password.... his are always crappy (so they're "easy to remember") and usually have the abbreviated company name in them. He also likes adding numbers, generally two-digit numbers, and has a thing for 7s and 9s. Mix in some caps, spaces, order...

Took me a few minutes, but I managed to figured it out.

"Nevermind, I guessed them." I reported.

After getting into Cloudinary, I couldn't find anything amiss. Everything looked great. No outage warnings, metrics looked fine, images all loaded. Ex-cto didn't revoke payment or cancel the account.

I checked our app; everything started loading -- albeit slowly.

I checked the aforementioned site; after a few minutes, everything loaded there, too.

Not sure what else to do, and with everything appearing to work, I said "Fixed!" and closed the issue.

About 20 minutes later, the original person said "thanks" -- never did hear anything from the ceo. I've heard him chatting away in the other room the entire time.

Regardless, good thing for crappy passwords, eh?

It's sometimes funny to see ridiculous password restrictions on websites and noticing that they don't care about your username except for maybe two things at all.

That moment when your username would be more secure than your 6 letters, 2 numbers, no special characters password.

If it wasn't displayed public on most platforms.

My school stores everyone's username and passwords (including admins) in plain text on a Windows 2007 server that they remote desktop into.

Girlfriend: There are so many passwords to remember, man. What's my amazon password, baby?

Me: Just use a password manager?

Girlfriend: That sort of thing exists?

I wanted a long, secure(ish) password.

I opened VI editor and told my mom to close it..

I used to work in a call center for a local hospital.

One night, all of our lines are swamped. Literally no time for a break between phone calls, +15 minute wait times. I answer the next call:

Me: "Its a marvelous Monday at AskIT, how may I help you?"

Doctor: "This is Dr. [Noone Care]. I need you to fix my password now."

Me: "Absolutely! You should be able to enter a new password now."

Doctor: "MY HANDS ARE NOT FOR PASSWORDS, MY HANDS ARE FOR SURGERY!"

😩 So glad I don't work for doctors anymore. Oh and the best part is, he had selected the general phone queue, rather than the doctor queue (~3 minute wait time instead).

left a company over 3 years ago because they wanted me to dumb my code down so that the other devs could understand it. they wouldn't allow me to use classes in my code lol. anyway, 3+ years later figured I would try to log in to some of the admin panels... passwords still the same. MySQL dbs... passwords the same... cpanel... passwords the same. smh. even if I still worked there the passwords should be changed every so often. top notch security right there. funniest part is they don't even do backups or use VCS for the code. sad sad company. glad I'm no longer there. my personal projects have more security, redundancy and fail over lol

Worst passwords of 2017

No, MD5 hash is not a safe way to store our users' passwords. I don't care if its been written in the past and still works. I've demonstrated how easy it is to reverse engineer and rainbow attack. I've told you your own password for the site! Now please let me fix it before someone else forces you to. We're too busy with other projects right now? Oh, ok then, I'll just be quiet and ignore our poor security. Whilst I'm busy getting on with my other work, could you figure out what we're gonna do with the tatters of our client's business (in which our company owns a stake) in the aftermath of the attack?

Today Comcast told me my account password over the phone... Fucking Comcast stores passwords in plaintext.

I started using Keepass and changed all my passwords to auto generated passwords. Somehow, my PC crashed before I saved the database. That was the day, where I lost access to my primary email address.

"Lets store passwords as-plain-text"

Me lost in my work, interrupted by two dudes claiming they wanna do a security audit on my pc.
Me: Go ahead!
Them : (accessing the mail site and sees creds auto filling.) what is this? This is a clear violation of security policy
Me : I use password manager called keepass. It's the most secure way to manage your credentials with key and password protection. I go ahead and lock the database and refresh to show there's no auto fill.
Them : (a little startled) still this is against policy, blah blah... You've not got authorization from us to install it...
Me : okay will do.
After some rounds of bullshit,
Them : tries to login using their credentials to report the *findings*. Takes a pause and asks, my password won't get stored right?
Me : This is not a fucking key logger.
Me (internally) : Just the fact that they think you're capable of identifying security issues bums me!

Too week 😋

My dad got a job at TD (bank)

We where talking about their computers and stuff. Then we started talking about passwords.

Keeping in mind that this is a bank....
Here is their password rule:

6-12 char long
All lower case
Only letters and numbers

(Passwords are stored on a legacy system)

Why?

Why should I trust that bank??
And also.. how do they expect to be extremely secure??

Notice :

Citizens are advised to store all their passwords into either text files or Google Keep, OneNote, Evernote so that it would come in handy whenever you forget the Password.

Please share this among your family and friends.

Have a nice day :)

Relying on Chrome to remember all my passwords. I have no idea any more what passwords I have chosen for several important sites. Don't even want to think about what happens the day I switch PC or reset that cache somehow.

Boy, sure wish I knew about this before putting all of my passwords into lastpass. This looks way more secure. Handwriting in English is pretty much as good as encryption.

Sites that store plaintext passwords in 2017...

Encrypting passwords with AES and storing the decryption key alongside te passwords file.

Oh my fucking god... I am looking at this code written by a previous developer and he put the passwords in plain in an array in a PHP file, like WHAT WHERE YOU THINKING? (btw that's also how he checks the password, just check whether it's in the array)

c'mon pls

HOW FUCKING HARD CAN IT BE TO NOT STORE PASSWORDS IN CLEARTEXT AND THEN PROCEED TO SEND ME AN UNENCRYPTED EMAIL WITH THE PASSWORD IN IT??? THE SITE HAS A PREMIUM FUCKING SSL AND SAFETY CERTIFICATES YET THEY STILL DON'T COMPLY TO THIS? FUCK YOU! IF IT WASN'T FOR THAT I HAD TO ORDER A NEW SCREEN FOR MY BROKEN PHONE, YOU COULD'VE SUCKED BETTER THAN ME + VACUUM CLEANER.

Sorry abt that. But for real, mytrendphone stores passwords in plain texts and waves a fucking safety certificate in your face...

"I know, I'll set my password as '12345'. No one will guess it because it's too simple right? RIGHT?"

Just received a mail from my college that my college's student account password does not contain any special characters and I should change it immediately. Wtf? How did they know that?

"The default password is your birthday"
They don't even make you change it

A few weeks ago I stepped onto the grounds of lovely Canada. Back then - coming from Europe - I was surprised. Free WiFi everywhere without all the bells and whistles of creating an account and such.

Well ... at least I thought so ...

Today I went to a location where they actually charge you for their wireless services - fair enough the coverage area is pretty huge - and provide you with an access coupon. All good my optimistic me told me but once the login page loaded...

There are a lot of things about UX I could rant about but let's put that aside. The coupon came from the office where they KNEW all your contact details but it required you to create an account with all of them again to redeem the coupon.

Not only that but it asked for things like the phone number - obviously asking for a Canadian landline number since hell who uses mobiles anyway with numbers longer than ten characters?! - and even though it had a nice country selection it kept the states field there even when selecting a country that doesn't have states ...
Oh, and on a regular phone screen (which would be the target user for WiFi on a campground I suppose) the input fields for state and zip were occluded by the margins of the input rendering the content invisible.

And if that weren't enough after creating your account they made you watch an ad as if the personal data and the 4$ you paid them wasn't enough for the lousy 400 KB/s you get for 24h ...

Gets better though! After creating the account they display your password to make sure you remembered it ... over a non-secured WiFi network ... and send you an email afterward ... password via unencrypted mail via an unencrypted WIRELESS connection ... not that it protects anything that would matter anyways you can just snoop the MAC of your neighbor and get in that way or for that sake get their password but oh well ...

Gosh, sometimes I just feel the urgent need to find the ones responsible and tell them to GTFO of the IT world ...

Is it just me feeling like this about crappy UI/UX design? Always wondering...

/backup-customers.php

No auth, nothing just called it and it executed a mysqldump of the whole database and provieded it as download - with also simple md5 hashed passwords. Fixed it by deleting the file.

Storing passwords in plain text.

To be fair, it was a feature requested by the client, but still...

At least encrypt it man.

Recently, one of our passwords was accidently published on a public page for a few minutes before it was noticed and removed. Unfortunately, this password opens nearly every locked account so it's a pretty big deal.

Management was informed of this mistake and told that we should change the passwords as well as implement a few other protocols to make sure this doesn't happen again including things like unique passwords, more secure passwords, using a password manager, etc.

Their response? It wasn't online long, probably no one saw it. There will be no changes in how we handle ours or our clients' secure passwords.

Unencrypted, plain text passwords stored in SQL, from lowest role all the way up through Admin. In the same system, they had a "backdoor" password that would log in any user...

Never ever have a tab open on production server database. Changed all users passwords by mistake. Thought was my test database.

Oh the irony: one of the e-banks I use, forces users to type their passwords via virtual on screen keyboard (javascript based!!!) due to security 'standards' yet in the same breath doesn't allow a user to use any other character for password besides the basic alfanum.. o.O fml

Are there any website or public list that shame companies and websites for sending passwords in plaintext whenever we tend to reset the password?

when you work for a place that has plain text passwords in the db. lol
I asked head of department if he knew what salting/hashing passwords was and he said no.... is this real life?

My ISP stores passwords in plain text, authenticates in plain text, phone calls to their VoIP server are in plain text. I still use it because of my VPN server - my own security device to bypass their incompetence. And they're cheap 😋

At 5AM I read a postal letter that had my password in it (how do they know?!) and decided that this is it. Sent an email to tell them how critical this is, and how huge the attack vector is.

Luckily for me, the support guy relayed it directly to the CTO. CTO mails me back 10 minutes after with an apology and explanation why they will fix it somewhere this year. This year..!

I understand that you have to abide by the government's requests (which by the way have many critical vulnerabilities themselves) and that you have to to test first before deploying the changes on production. But a full year?!

Now, let's think progressive. I want to work for them and make those changes myself. If I send off my CV and request an interview, then mention these things during the interview and that the CTO himself got back to me, what chance would you give me for getting in? I don't have a diploma or any certifications, but I have my own personal servers (OpenVPN, OpenSSH, Postfix etc) and a bunch of experience.

My trusty password manager, so I dont have to remember those shitty passwords. (its however being rebuilt after a failed firmware upgrade who bricked it).

By the magic of Javascript, I made an unhackable password!!!

Forgot my password at school, say so, they tell me the password. Have they never heard about security?

Tesco.com, you deep pool of creamy baby shit. I've tried to reset my password three times already. My new password has way more entropy than your mathematically impaired rules command, but apparently using password managers is bad practice. It should be about having at least one special character, not EXACTLY one. I've got lots of uppercase characters, not PRECISELY one.

If your site asks me to log in and doesn't implement OAuth with Google or at the very least Facebook then go fuck yourself.
I have enough usernames and passwords in my head, I don't want more.

So, what have We learned in this week (wk25)?

There are two types of websites.
The Website, which allows setting passwords Like "123", and the Website that says that your firstname is too weak and must contain lowercase, uppercase letters, requires three or more Numbers and at least two Special characters.

The "Change Password" function autofilled the old password. Dev told be it didn't matter because "if you set the field type to password you can't see it".

If($password = $password2) {
//login
}

Keep in mind that password is the salted and hashed input and password2 is the Salter and hashed pw in the database...

Who needs passwords am I right?

Our sysadmin just wrote our new work account passwords on our office whiteboard, visible to everyone... Now that's how you create chaos

Beware, eye cancer ahead 😷
A cleartext password in a variable of all things..!! This is why shitty companies get hacked all the time.. THIS IS IT!! 😡

Was looking through the most used passwords list (the one that had 'removed my password from lists...'). 'password' is like one of the top one, and then 'PASSWORD' is 810th !?!?!?! At least it's before hentai...

!rant
Damn github is da shit.
I'm sure all of those people who ranted about committing their passwords and keys will be happy
PS. I don't know if this is new but I'm happy either way :D

When your school doesn't give you the root password of your openSUSE laptop but an encrypted file with all the passwords of the school even the director's one just to stimulate you

Tldr; make sure what you study is relevant to the field and you enjoy it otherwise don't waste your time.

BTW: devrant is awesome it gets me through the day.

So I am almost 3/4ths through a master's in cs and I am contemplating why I went to school in the first place/dropping out.

My program is basically an extension of the bs I got from the same school meaning we learn very general cs topics. There is only one ai class for example.

I had a junior developer position before I even got my bs so now that I am this far along and looking at job openings I'm wondering what why and how my school is able to get away with teaching us this shit.

After all my schooling I learnt more on my own and through Google. I have little to show for my school work other than a degree that says I did a bunch of busy work. And the specific things that I did learn I will never ever remember. Seriously. Who here knows what a MIB and OID are and have actually used them?

I wish I tried harder to get into a school like Berkeley but just looking at their applications is depressing. I always had issues with school and they expect my to have the grades, extra curriculars and other shit. I'll build you a robot or make you a website but I'm not doing that nonsense.

And then there's Google and apple and all these big tech companies expecting me to have written full Enterprise software and know every single algorithm and programming language because everyone uses something different. Sure I wish I had experience in all 50 languages that are popular right now but I don't. And I'm not gonna learn it from school that's for damn sure.

Who here actually went to a good school and can say it helped them in the real world? How many employers actually care about school over actual experience?

Who knows how to burn a school down and get away with it? Or at least make teachers with Phds stop reading off slides all lecture. I know how to fucking read for fucks sake. Not too mention they use shitty software made in 2003 that's no longer supported. And I could go on about the teacher last quarter who graded the midterm on final day while he flirted with the 3 girls in class. And I could go on and on and on but I feel like I need to start being productive so I don't waste away.

Just so done.

I looked into the code of the website of our company. One of the first things I found was that the Login was hardcoded with clear passwords. So everytime a new user needs an account the code has to change.

I still can't understand how people can do that.

I'm going to add "Ability to memorize numerous passwords" to my resume.

No! GitHub says bug exposed some plaintext passwords!

How secure are you passwords guys? Like specifically, along with your username.

A few years ago I found a public AWS S3 bucket owned by a fortune 500 company containing a database dump backup with all of their users unsalted md5 hashed passwords.

I didn't report it because I don't want to get sued or charged. I don't know whether it's still public or not.

Yup, long weird strings are the way forward.

Default passwords

My ex-Physics teacher didn't have a towel with him today 😢

Btw I left this on the library "core" computer

That moment when you find out your school is using unsalted md5 passwords, and your school project requires using it too... FUCK

Tl;dr stupid password requirements

Begin quote

Password must not contain any non-alphanumeric characters.

Your Password change was not accepted. Enter your current Password correctly following the rules for New Passwords. Please try again.

Passwords must be between 8 and 12 characters in length and MUST contain each of the following:

At least 1 lower case character (a-z)
At least 1 upper case character (A-Z)
At least 1 numeric digit (0-9)

But, MUST NOT contain:

more than five repeating characters in a row (e.g. 111111356 would not be valid, but 112233445 would be valid)
spaces or other special characters

NOTE: Your new password cannot be the same as any of your 10 previous passwords.

End quote

Are you fucking kidding me? Only (26+26+10)^8 through
(26+26+10)^12 different passwords to go through? It's like the oxygen wasters that built this website give zero fucks about security.

Why? This is the site that manages money and investments. Just allow passwords up to 64 characters, allow any ascii character and just fucking encod the characters to prevent any Injunction.

Client from a big company requested that all sensible data should be encrypted, passwords included.
We agreed that was OK, and that we were already saving the hashes for the passwords.
The reply was "Hashes should be encrypted too"

Oh, my fuck! Why didn't I try implementing passwordless authentication earlier? Creating apps is so much less complex when you don't have to fuck around with passwords.

*changes auth details for all current side projects to using magic links*

Signed up for a driving class...
This is what i get in the mail shortly after.

Fucking fantastic guys! Saving passwords plaintext. Is it because of the government?

First of all how the fuck you are able to tell that MY password is one of many that have been stolen? How you are able to get those stolen passwords AND WHY YOU ARE EVEN ABLE TO COMPARE THEM?! Are you storing as plain text or just randomly salt all stolen passwords and chceck if they are in your base?

Now that is an INSTAdelete.

Just saw this during a speech ... 😅

Updating code for big client.

Find that they are not encrypting passwords in the database and are not sanitizing user input from forms.

Do not trust the user!

Let's teach the class about security. OK *spends 1.5 hr teaching about encryption and practices* OK now students make a login page and just store the passwords in a JavaScript array....... *Facepalm*

After watching Mr Robot, I installed Kali and learnt to hack WiFi passwords via brute force. Was utterly disappointed that, most crackers just use prebuilt tools instead of developing their own algorithms and programs.

Aaah! Another cup of stupidity on this sunny Friday! 🍵

I just received a csv file with usernames, emails and passwords in plaintext for 1500 users.
Apparently that's what it means to "integrate with our database"

When you forget your password, go to change it and get greeted with:

"Your new password cannot be the same as your current password!"

Reset 65 passwords today already, a new personal best for one day! No idea why the reset password button is so hard for clients to use, aghh!

Why the Fuck is PayPal only allowing passwords up to 20 characters . Even the most useless websites aren't doing that (at least not visisible, maybe they shorten it in the backend).

Guys, this I am very tired of companies auto generating passwords for you and sending them to you in an email using plain text. Do they not care about the security of their systems?

I found a company called SDF.org which claims to have been established in the 90s. Their website, even the server feels very old school. But I would think that if a company is really that old, WHY DO THEY SEND YOU PASSWORDS IN PLAIN TEXT FORM. You've got to be kidding me. Has noone ever tried to hack them before? Are they not worried at all that their dial-up service is going to go down?

For security reasons and to have stronger passwords, my organization enforces us to use '@123' at the end of the password!! Dumb motherfuckers!! :P

I will immediately change all my ”123456” passwords.

Uhm. I don't like this

* le me signing up *
"choose a less commonly used password"

5 tries later, of combinations:
"choose a less commonly used password"

Well, fuck you too! I tried all passwords I could easily remember! Do you want me to sign up or WTF?!?

(I'm trying a system out, I don't wanna get it through my long-ass keychain)

Registered an account with a local pizza business and rated them 5* on Yell moments before checking my email and finding they had emailed me my unencrypted password, GREAT NOW I WON'T BE ABLE TO EAT

So I worked in a company whose WiFi password was 1234567890 and they on the network they had a NAS that was not secured with the passwords to all the clients servers and online accounts on the root.

Security Horror Story:

A password authenticator which is case-insensitive and all special characters are treated as the same value. As a bonus, all passwords are truncated to 4 characters.

plaintext passwords
🙈

Just reviewed the code of an online financial system used for managing payroll and investments. Cracked the admin password in less than three minutes.

This is a system operating in a sector with regular audits, how am I the first person to spot how bad this is?

When you spend 5+ minutes creating a secure password for your new bank account and you get a message saying the password must be between 6 and 12 characters long.

Not sure I want to open this account any more.

Fuck me.

This is why having strong and secure passwords are important. Your social media team must be ass BWW.

Why do some websites have password limits? I want to have unlimited characters for my password.

"The password must have 7 or 8 characters (numbers and/or letters)”
says Movistar, the biggest ISP and telecom company in Spain ... I can't even.

HOLY UNICORN TITS fuck passwords and my incredibly weak short term memory lol

Installs Nessus. Creates Admin account. Forgets to save the 32-char random password to a password manager and locks himself out. Installs Nessus...

Password Rules are bullshit. I am the one to decide what password is safe for me. If even I can't remember my password it's not fucking safe. Morons.

Following on from my school having terrible passwords. Turns out they stored all our passwords in plain text somewhere - so some script kiddie (Do you even need to be a script kiddie to find this - probably not, but the guy who did this was a script kiddie) could just remote log me out twice, log in as me, be a twat, and have a conversation in Notepad.

Clients r wankers. He wants to be able to send login details incl passwords in email to his clients when he adds them in the cms. The passwords are encrypted and generated on creation of a new user. Ive told him that sending credentials in email is shit and not secure. The stubborn bastard wont budge, so instead i've put explicit instructions to reset password once logged in with the credentials they send. Any other suggestions?

It amazes me how quickly give out their passwords. I ask for a person's user name and I swear at least 75% of the time they give me their password too!

New way of storing passwords "securely":

1. Open word and write your passwords in plain text
2. Save that word document and open it in notepad
3. Delete a random character but remember which one and in which position & save

Now the document won't be accessible with word and to fix it you have to put back the character you deleted.

Password

Colleague just found out that redislabs silently truncates passwords to 20 characters. Naturally our development department was horrified. It also explains why we couldn't access our account anymore. Who would even come up with such a thing?

Domain server goes down, it's the gateway and DNS too.

Ok I'll just remove the domain, it's been orphaned really since you went to the cloud.

Don't have local admin password.

Ok call old it company who set up gear

Out of business

Ok boot to Linux and reset

Usb boot locked

Don't have bios password

Call old it company

Still out of business.

Wait, can I just set manual ipv4 ? Ok domain without a domain controller... If it works it works.

Does anyone of you know a good website where I can learn about open-source licenses?
I've written a small terminal-based passwords-manager in Go want to open-source it and some of the libraries I've written for it.

And another shitty hoster...
Translation:
“The password is to long. Please choose a password that is not longer than 16 characters”

I saved passwords to db hashed to SHA-1 with no salt... I left that company but I'm sure that application is still actively used today.

Omg how stupid some people are... Today at my university I used the first time one of the computers in the computer room and there is a portable Firefox installed in a shared space on the computer and that is also where it saved settings etc. So this is the same for every user on that particular computer.

And when I checked the security settings I found that about 10 different accounts were saved and accessible with website username and password.

So of course the shared space Firefox is bad, but you still shouldn't save you password on a public computer :S

PS: If anyone needs a webmail account or an account for the german university network contact me :P

Yesterday was the day. I got asked. Asked, if I could hack back someone's "hacked" Instagram account. For the first time.

He's probably one of those dudes who use short and easy passwords, so his password was just guessed.

My university has a internal developed system, where everything is managed from e-mails, exams to personal data.

What I'd like most about it, they talk all day about Internet Security and store our passwords in plain text and if you press the "I've forgott my Password button", they even send your password unencrypted, plaintext via e-mail. (Hello Wiresharks)

I don't know how to feel about this, it just hurts :(

Finding out a service your school uses doesn't bother encrypting passwords is always fun, isn't it?

Best password manager?
I usually use the post-it-jutsu art to save my passwords.

But I think that when you have too much passwords, there should be a better way to store your info.

My password manager!!
I use passwords I can never remember, stay logged in, next time I need to log_in I use the passqord forgotten button, reset it with my e-mail or better phone

Don't you just hate *silly* password restrictions? Surely there is a very limited number of possibile passwords

On top of this their "password prompt" says passwords are between 6 and 10 characters...

Just found out that a big hosting provider saves a user's SQL and FTP password in a plain text file just at the parent folder of the normally accessible ftproot.
Using some linux commands you can
cat ../mysql_pw
cat ../ftp_password.txt
IT'S NOT EVEN ENCRYPTED OR HASHED
(This is tested on a minecraft server, would also work on other services)

A lot of larger companies seem to be a happy about forcing employees to change their password every three months or so. They do it for security measures so that it is more difficult to break through the system, however most people end up making the worst passwords.
Instead of forcing a very good password on them every year or two maybe, they all end up having passwords like: "Summer16", "Qwer1234", "London15".
I used to work for our national police, and this was the case there as well...

I set up unRAID on my server this weekend, and only just checked my logs to see if anything weird was happening. Turns out 2 IPs have been trying to brute-force the SSH password all weekend. I quickly installed the DenyHosts plugin and reminded myself to always use a strong password, which luckily I did.

A bit later now, and one of the 2 gave up, the other one keeps trying but of course the connection is refused. Just keep trying buddy :P

Am I the only one whose passwords are 256-char long and randomly generated?

I really think it's like to make passwords a thing of the past!

Hacking is awesome and looks easy!!! And seems like even pentagon might have toooons of exploits and backdoors, and qwerty passwords !!
After watching Mr. Robot...

I am doing some freelance work for a client who is thankfully mindful about security. I found out that they are so strict with their access because they had a huge data breach last year.

Today I was given access to their repo for connecting to their AS400. In the docker file the username and password were included and were the same for dev and prod. They also are performing no sql injection prevention. They are just joining strings together.

Why are the MOST important passwords in my life (banks, financial, insurance) the LEAST secure (i.e. Max length 12, no special chars)

Guys. I think h1z1 stores passwords in plaintext......

To all the privacy conscious people

Does anyone know your/one of your password(s)?

The most annoying co-worker(*team*) I have worked with just signed off a custom project that uses plain text passwords, hard coded into a file.. PLAIN TEXT!!! NO HASH!!! NOTHING!!! The same team also told me that working in feature branches cuts into their productivity, but they want CI/CD implemented NOW!

You know this MD5 encryption?

Me too - especially when saving customer passwords 😂

Boss hired a freelancer to work on a new reporting dashboard. Freelancer also built a backed. Boss wants me to work on fixing that backend. I check out the DB first only to find plaintext passwords. I threw up a little.

I think I have figured out a way of making memorable and secure passwords...

Look through your old code and pick the cringiest, the worst snippets of code you can find, and use them as your passwords

Wanted to make an account on Payoneer to get paid from 99designs for the stuff I make there.

Entered my password, got error.
"Please use only the latin alphabet, a-z and 0-9"

SERIOUSLY, it's banking stuff. how can they not allow secure passwords? *sitting here, crying"

Putting the API keys, secrets and passwords in the code and pushing it to git.

Just had a very "OMG WTF!" kind of mini conversation with my co-founder, of a web dev startup.

Him: So what's LastPass then?
Me: It's a secure password management system.
Him: So let's use LastPass instead of Dropbox then. :-)

** quickly searches dropbox for passwords **

A little knowledge can be extremely dangerous if left unsupervised.

What password manager do you guys use? Lastpass, 1Password, Dashlane, else? Any suggestions?

About 5 years ago I worked at a small company developing websites and .NET applications.

They haven't changed any passwords which means, I still have access to ALL of their customers DNS setups.

Of course I wouldn't do anything.

But just the thought, that I could make an infinite loop, by redirecting the domains, is amazing.

Or redirecting them to a porn site.

This is the kind of company that provides online ticket sales for one of the bigger cinemas in Italy. Yes, registration is unavoidable.

Is it safe to store sensitive passwords like servers root on chrome?

Using firebase database to store username and passwords.

Every time I go home I have to switch all my passwords, because my little brother watches me type them and memorize them. Every damn time. I'm running out of passwords.

It's gotten to the point where I am legitimately impressed when I can tell a service is hashing their passwords.

All of these unnecessary complications of "must not have more than 2 of the same character in a row" but "can't be more than 12 characters" requirements make me think that the passwords are being saved in plain text.

Amazon and Dropbox do it right - present the user with an input box and no requirements printed anywhere.

Not only is the default password they set a piece of shit, the password field actually shows the password even after you save it, why even bother with security?

Hash your fucking passwords!

The internet kills my insides.

My passwords are so secure, they want to talk about sex with me.

Thank you microsoft. You clearly got that right. If someone knows how to make passwords secure, it's you.

... Is this what you wanted to hear? Because it looks like you have no idea what you're doing.

Sysadmin's nemesis: a DBA. Especially an oracle DBA. There's no other kind of tech worker I've seen who's more opposed to best practices.

How about for devs?

I needed to log in on a website in someone else's pc and didn't know the password by heart. I thought I'd log into chrome, if I log out later, what could go wrong right?

Apparently, a lot. It facking merged my bookmarks, history and passwords with hers! And she had shitloads of them! It took me facking hours to clean up the mess chrome created. I trust her, but I still didn't want her to have my passwords etc.

Omg I'm never logging into chrome again elsewhere, what a frustrating facking waste of time

Is there a good technical reason to not allow passwords to contain special characters? My isp does this and I need to know why.

hashing passwords atm.

i have a java backend, should i look into bcrypt or just use a loop?

also how many times would you recommend i hash passwords?

and should i look into hardware acceleration?

Weak passwords....

People, even on devrant, are complaining about having to change their Twitter passwords. A major security event is not the only occasion to change your password (for anything).

You should change your passwords for everything regularly. Like, once every month or two.

This is why password managers are brilliant.

More emarassing than frustrating..But I was applying to a couple internal positions recently and decided to bring in a sample package to demonstrate some of what I had been working on in my current team. They seemed to like the example and the interview seemed to go well...A couple hours later one of the managers came by my cubicle and asked "is that the real password?" and pointed to a line in the code. Sure enough, I had left a plain text password in the script I had just handed out to 10 panelists at 2 interviews..proceeded to collect the packets back. In the future I'll be paying closer attention to what I include lol.

Still frustrated we keep the passwords in the script though >.> any suggestions for better storage of passwords and the like in Perl scripts?

We just had the introduction lesson about Emails. I think our teacher had fun sending fake mails from his computer over the server under our name.

I hate password restrictions that enforce all kind of limitations but then also limit you to a max of 16 ANSI characters ... i want passwords like this pѬѬasѪ"§§)("!编/)$=?!°&%)?§"$(§sw

Just found out today via Reddit that Wells Fargo, American Express (not personally confirmed), and Chase login passwords are NOT case sensitive!

I would check your bank too!

I save all my work relate passwords in a single text file on my computer. I always have it open too.

Too many systems, too many password requirements, expires too frequently.