31–40 of 81 posts
Being overly suspicious of everyone is a terrible way to live. Maintenance should have the autonomy to do as they did here - and security correctly followed up. The right response should only be technical imo. A meeting room should not lead to this level of network access.
Earlier quoted context omitted.
It's not my field, but at least at my work the network can somehow tell the difference between an authorized user and not. It is not simply using the MAC address. A guest device connected to the ethernet port in the conference room has the same access as a device connected to the guest wifi, a staff laptop has it's usual access.
Probably a RADIUS server setup. Basically staff machines get a certificate to present to the server and the server controls the network. So, if your machine does nothing, it's on the guest vlan and has limited access. If it presents a valid certificate that network port is reassigned to the staff vlan and you get full access. If someone leaves, you just revoke the certificate and they have guest access again. Not roc…
What always gets me about these red team attacks is the same thing that gets me about internal phishing test emails. My company sent an internal phishing test last week. Several people immediately reported it to a cybersecurity engineer, posted about it in Slack, saying they were surprised that such a sophisticated phishing attack was happening. I too was surprised - Google is usually much better about catching these…
Earlier quoted context omitted.
Expiring passwords are one of my biggest gripes, and I still see them everywhere
Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?
Earlier quoted context omitted.
Expiring passwords are one of my biggest gripes, and I still see them everywhere
Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?
Earlier quoted context omitted.
Letting users pick their own passwords has always been a mistake. If passwords are needed, the system should choose them.
As a person with memory issues, this is a recipe for me writing a password down where somebody else can probably find it.
Earlier quoted context omitted.
Letting users pick their own passwords has always been a mistake. If passwords are needed, the system should choose them.
As a person with memory issues, this is a recipe for me writing a password down where somebody else can probably find it.
Earlier quoted context omitted.
Expiring passwords are one of my biggest gripes, and I still see them everywhere
Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?
Earlier quoted context omitted.
Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?
I ran into a website for work that would let you create a long password, but silently truncate it to 12 characters before saving. Mind boggling.
Earlier quoted context omitted.
Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?
I ran into a website for work that would let you create a long password, but silently truncate it to 12 characters before saving. Mind boggling.