Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers shoveled snow for company, were rewarded with network admin access

theregister.com

Post reply on HN
Print view View original

71–80 of 81 posts

Re: Hackers shoveled snow for company, were rewarded with network admin access

#71

Post by pseudohadamard »

ryandrake wrote: post #35
grg0 wrote: post #28

Earlier quoted context omitted.

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

And content limits. Why can't my password contain the % character? No special characters? What makes a character "special"? Why can't it contain emoji? So many password systems go to great lengths to remove potential entropy and randomness from passwords with their rules. The usual excuse is "blah blah blah legacy systems" which is not a good reason.

I agree, content limits are a royal PITA. Do you know how long I had to search to find a password manager that would accept my password with its doodles, sign language, and squirrel noises?

Re: Hackers shoveled snow for company, were rewarded with network admin access

#72

Post by UnfitFootprint »

lokar wrote: post #31
UnfitFootprint wrote: post #20

Being overly suspicious of everyone is a terrible way to live. Maintenance should have the autonomy to do as they did here - and security correctly followed up. The right response should only be technical imo. A meeting room should not lead to this level of network access.

A better approach is to train everyone to be polite and helpfully walk the person to reception, who can arrange access.

Yeah, true.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#73

Post by alessandroberna »

ChrisRR wrote: post #4
Xeoncross wrote: post #3

Earlier quoted context omitted.

1. Open a web browser and do a search 2. Read until you find a sentence that you like. 3. Use it as your password

I like the last line of your comment My password is now password

Now you might want to open a pr like this one: https://github.com/danielmiessler/SecLists/pull/155

Re: Hackers shoveled snow for company, were rewarded with network admin access

#74

Post by Kirby64 »

shalmanese wrote: post #69
grg0 wrote: post #28

Earlier quoted context omitted.

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

> Why can't my password be a 5KB long Because that opens you up to an entirely new class of attack. You have to set the limit somewhere and if you set it at INT_MAX, then a malicious user could find a O(n^2) path in your password validator and input a 4GB password that locks up the machine. Or they could create 1000 users in a row with 4GB passwords and fill up your storage.

> Or they could create 1000 users in a row with 4GB passwords and fill up your storage.

Not an issue if you’re storing passwords properly. You don’t store the actual password, you store a (hopefully) salted hash of it.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#75

Post by ornornor »

alt227 wrote: post #24
mikestew wrote: post #2

”Finally, the company should have enforced a strong password policy that would have prevented our heroes from finding dozens of accounts with “winter2023!” as the password.” Capitalize that “w”, and you’ve got a password that will pass most PWD policies. Why do they think it was “winter2023!” to begin with? In 90 days when the PWD expires, well, it will be spring of the next year, so… The better idea is to require pa…

Expiring passwords are one of my biggest gripes, and I still see them everywhere

I worked some (terrible) place that did that and wouldn’t allow you to use your last 3 passwords. So what we were doing is that when it was time to rotate password, we would change our password 3 times in a row and on the fourth time we would just use the same password as before. This way our password never changed (the requirements for passwords were ridiculous) and the box could be checked in the audit.

Also the same company: we ran a version of our artifact repository that had a 10.0 CVE for almost a year. It was too much work to update it, couldn’t spare the resources.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#76

Post by ornornor »

sfn42 wrote: post #55
ryandrake wrote: post #35

Earlier quoted context omitted.

And content limits. Why can't my password contain the % character? No special characters? What makes a character "special"? Why can't it contain emoji? So many password systems go to great lengths to remove potential entropy and randomness from passwords with their rules. The usual excuse is "blah blah blah legacy systems" which is not a good reason.

Probably because there is some mildly decent reason (or very good, I don't know) to avoid them and it really doesn't matter enough to worry about getting around it. Why would you want emojis in your password? It's a piece of text not meant to be seen, emojis are meant to be seen. Just randomly generate some characters and get on with your life. I don't understand why you care about this at all, it's such a pointless…

To me it signals bad engineering in the underlying system which doesn’t exactly encourage trusting the system with my data.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#77

Post by ornornor »

sgc wrote: post #38
grg0 wrote: post #28

Earlier quoted context omitted.

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

I ran into a website for work that would let you create a long password, but silently truncate it to 12 characters before saving. Mind boggling.

Happened to me a few times. And then your password never works and you can’t understand why.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#78

Post by alt227 »

magicalhippo wrote: post #57
grg0 wrote: post #28

Earlier quoted context omitted.

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

> Why can't my password be a 5KB long? You should switch to Windows, Microsoft got you covered[1]. [1]: https://www.betaarchive.com/wiki/index.php/Microsoft_KB_Arch...

Never seen that bug before, thats a dozy!

Re: Hackers shoveled snow for company, were rewarded with network admin access

#79

Post by sfn42 »

ornornor wrote: post #76
sfn42 wrote: post #55

Earlier quoted context omitted.

Probably because there is some mildly decent reason (or very good, I don't know) to avoid them and it really doesn't matter enough to worry about getting around it. Why would you want emojis in your password? It's a piece of text not meant to be seen, emojis are meant to be seen. Just randomly generate some characters and get on with your life. I don't understand why you care about this at all, it's such a pointless…

To me it signals bad engineering in the underlying system which doesn’t exactly encourage trusting the system with my data.

I think simplicity is good engineering. Bending over backwards to support pointless usecases isn't good engineering. Almost nobody would use this and the ones who would don't need to. Why put in the effort?

Re: Hackers shoveled snow for company, were rewarded with network admin access

#80

Post by lima »

EvanAnderson wrote: post #46
lokar wrote: post #32

Earlier quoted context omitted.

Still better to do that same thing (cert based auth) at the application layer instead of the network layer.

That's great when you have control of your applications. For most corporate IT you're stuck with COTS applications and whatever their built-in auth functionality is. Sure, you can probably bolt a reverse proxy in front (if you're lucky enough for it to be a web app and not a thick native code client) but you get to argue with the vendor when they refuse support because you're not using their recommended configuration…

Even if you can't authenticate at the application level, it's still much better to encrypt/authenticate traffic on the wire (using a VPN or something like Tailscale) instead of 802.1x auth.
Post reply on HN