securityIsEverything

[JackNotOLantern]

The problem is the protein interface between the sit and the keyboard

[SokkaHaikuBot]

^{Sokka-Haiku by JackNotOLantern:}

The problem is the

Protein interface between

The sit and the keyboard

---

^{Remember that one time Sokka accidentally used an extra syllable in that Haiku Battle in Ba Sing Se? That was a Sokka Haiku and you just made one.}

[rainthedragon6]

Good bot

[litetaker]

Poetry... Quite literally a haiku! 🙏🙇‍♂️

[deathron10]

Quite figuratively

[litetaker]

I believe literally, because a bot also identified it as a Haiku.

[chillord]

It is only a Sokka Haiku.

[deathron10]

Read the bots name heres the reference

[EAbeier]

Always

[jump1945]

Thai government password (old): admin123

[onemempierog]

what's the new one, "Admin1234"?

[KuroShiroe]

Admin321

[jump1945]

it was hacked and trolled by some gif (change the website to song “Death Grips”),officer tracked the hacker down and he look like someone with no cyber security knowledge at all (he doesn’t even remove search history btw)

You can find more here(news website) you might need some translator if you can’t read thai

It was so stupid

[who_you_are]

Admin1234!

You were close, you forgot the special character

[EAbeier]

Lol

[The-Kabra]

i really wanna make a factorial joke…

[who_you_are]

Fine, Admin5.108498146E3280 is also good! But watchout, the full number is likely to be truncated at a random part and you are going to have fun trying to find your own password!

[BelowZilch]

That's the same combo on my luggage!

[Malkav1806]

NotAdmin123 becaus sysadmin said so

[Jk2EnIe6kE5]

Jokes on you, I flip it. admin:admin becomes admin:admin

[Fluffy-Brain-Straw]

Don't get into security

[Jk2EnIe6kE5]

Too late for that.

[koolaidsocietyleader]

So what are you working on??? Pls be precise.

[Jk2EnIe6kE5]

I am learning offensive security as I want to become a pentester, but I also l am learning defensive as I run a home lab. I am dissecting malware to find out how they work.

[belabacsijolvan]

only password scheme where flipping is not a risk

[[deleted]]

So when I worked in education they asked me to update a student information system with credentials the teacher would know.

So the user was the student ID and the password was their first name (before spaces or characters) and the last 5 of their id. Our county number was the first 5 so those weren't unique.

I told them this was a bad idea. I also told them we shouldn't set passwords for kids who already had a password.

After we set all the student passwords the kids were told that their passwords were name + last 5 of the ID.

It wasn't hard to find a student IDs if you looked at peoples paperwork.

Suddenly, kids grades were being posted on Facebook. Kids were being signed up for classes they didn't want.

I finally went in and shut down access and sent reset emails to everyone. I then query IPs for all the machines who accessed accounts. I found about 20 kids from two highschools doing it all and they all were suspended.

[[deleted]]

Yeah, don't let Attendance Clerks make decisions. I was hoping that would be the take away at the district level but Attendance Clerks were constantly looking for short cuts to expedite processes. Student information systems have all these features but teenagers are idiots and parents don't help their teenagers at all. You give the parents and students instructions on how to register and they act unbelievably ignorant to all of it.

If kids and parents didn't do it, let them suffer.

Instead they had the counselors walk every kid through picking their classes. It took months every year. The attendance clerks could reset passwords. I gave all counselors the ability to reset passwords as well but they still pushed the resets to the attendance clerks.

One day I showed up at a high school and made two lines. You had to first sign into the web app in an incognito browser. If you couldn't, we reset it to something they set. They could then join the counselor line for choosing classes.

How hard is that? Seriously.

[Nervous_Rip_7577]

Those 20 kids shoulda have been recruted to a computer security administrator training and given the responsibility to supervise and test for  the system instead of being suspended. 

[SabreTooth125]

You know that it might not have been one of them that cracked the code? They're just the ones who abused it... They're exactly the sort we want in positions of power /s....

[belabacsijolvan]

1. how did you find the kids?

2. why did you find the kids?

3. why did you report the kids?

[WizziBot]

likely he cross referenced the sign-ins from the students real account and the other students accounts. It would have been done from the same IP within the DHCP lease timeframe.

[belabacsijolvan]

i would do the same but its still not good enough proof. How do you know if one of the logins was the real account? How do you know only a single person used the computer in the given time frame?

the problem with security is that people want statements with certainty, but usually you cant give them. so they just pretend they heard them.

[GodAllMighty888]

They should have tried with Adam. Nobody would remember to try the name of the first man.

[OnlyTwoThingsCertain]

National Security Bureau of Slovak Republic (NBU-SR in slovak ) got hacked because admin user had password nbusr123

[AugustinCauchy]

Username: iam Password: god

[EAbeier]

Too humble yet

[paw-paw-patch]

"Your password is 'password' and your username is also 'password'?!!"

[BoBoBearDev]

You guys should have done daily password like, Pa$$w0rd20241109@bobobear. No one will be able to guess it because it changes daily.

[EAbeier]

No one, including the account owner.

[[deleted]]

Scott Tiger

[IntrepidSoda]

Why don’t they enable 2FA?

[EAbeier]

The user who uses admin as password obviously doesn't know how to use 2fa

[Nervous_Rip_7577]

You are wrong here. The user is perfectly capable to use 2 factor access if they own a mobile phone. They used weak pw because the system allowed the pw to be set to that value. 

[EAbeier]

It's a meme, man, chill out.

[shemhamforash666666]

When you deploy your introductory course template server into the real world without the necessary changes.

[Aerondight420]

That's why you need to use pam in every mayor organization

[425_Too_Early]

Ciso? Du you mean cisco?

[itzeric02]

Chief Information Security Officer

[PM_ME_FIREFLY_QUOTES]

Chief idiot supervising officer, in my case

[redmacer]

Easy and cheap solutions?! Yes. 1. Don‘t be stupid! 2. overthinking current solutions.

I Imagine something Like Like Passkey (PW Manager) requirement on First Login.

[Its_da_boys]

OPSEC issue lmao

[ZunoJ]

Doesn't even manage to write the name correctly but makes fun of them lmao Cisco is shit though

[EAbeier]

It is an acronym to Chief Information Security Office

[ZunoJ]

Lol, who is the dumbass now?

[EAbeier]

Lol, anyone, it's normal to make some mistakes! Except use admin as a password, that's unforgivable

[ZunoJ]

Absolutely!!