Unbelievably stupid in 2022.

[MuzzMelbourne]

I find it incredible that there are people who still do this. I find it even more incredible that in 2022 software developer’s and system security personnel allow this sort of thing to happen.

A Password Set To Password Leads To A $15 Million Ransom Demand — Forbes

There’s a long list of passwords that are so terrible that you should never, ever use them. Password is right at the top of the list.

apple.news

 

[ScandinavianFish]

This is why I have a hard time feeling bad for the companies that fall victim to cybercrime when the reason is seemingly always something easily avoidable

 

[ForgottenSeer 94654]

I find it incredible that there are people who still do this. I find it even more incredible that in 2022 software developer’s and system security personnel allow this sort of thing to happen.

Cyber security personnel rarely have the authority to enforce policies and to take actions when employees do not comply or violate policies.

How you gonna police every single employee's digital usage even in a small company of 500 employees? It is an impossible task, even with monitoring software. And management rarely implements the things that cyber security personnel recommend. That's even if the company has qualified cyber sec professional on staff. More like an overburdened general admin expected to do it all.

When budgets get cut, cyber security is one of the first to get trimmed. "Do more with less (people)." And there you have it.

 

[MuzzMelbourne]

Fair enough. Point taken. Maybe developers could include code like, if(dangerous password) then(reject)else(accept) and refer to a nice long list of potentially dangerous passwords to make the call. I guess my point is, how is it still possible to set a password to “password”, particularly in these circumstances?

 

[ForgottenSeer 94654]

Fair enough. Point taken. Maybe developers could include code like, if(dangerous password) then(reject)else(accept) and refer to a nice long list of potentially dangerous passwords to make the call. I guess my point is, how is it still possible to set a password to “password”, particularly in these circumstances?

Few companies validate authorized access configuration inputs whether for their OS, their apps, their infrastructure or their websites. Then you have the user - lots of companies don't want to be held responsible for protecting against "stupid" so they put the entire onus onto end user in the EULA. Well, making the end user responsible for just about everything is standard software & digital industry practice.

 

[MuzzMelbourne]

Amazing. Huh, you learn something new every day. Digital buck shifting!

 

[ForgottenSeer 94654]

Amazing. Huh, you learn something new every day. Digital buck shifting!

Some website developers are recognizing the need for strong passwords and making it such that the user must use them to create an account.

But what are you supposed to do in a 1000 person company, with only 2 admins, and they use the word "password" as the password for all their admin stuff on every single device in the company ? It is admin negligence, but at the same time those admins can be so overburdened and their management won't listen to them. So it is not so straightforward. You have to remember, unless something is mandated by law, companies will not do it. Companies want the pleasant fiction of a one-button solution that works silently and seamlessly and solves all their security problems. They don't want to hire the small army of security staff needed to properly protect even a small commercial network. Management does not understand security typically and they don't understand why something they have just downloaded is being blocked. Overall, the reality out there, while getting better, is both absurd and dismal. But revenue and profits always comes first.

 

[byronbytes]

They should make it so you just can't make your password password, or anything generic in that case. It's just like this image here

It's a gate alright, but you can literally just walk around it with no effort. Password is the most commonly bruteforced password that hackers go for, so why use it?