• (cs) in reply to Cad Delworth
    Cad Delworth:
    Well, at least you can tell if the event handler failed: that's the only case where you'd get ****** passed back instead of ********!

    Hangman: FUCK OFF YOU FUCKING ASSHOLE! Have I won the car, Vanna?!!

    Yes, you won the car, but the password to start it is "*********".

  • AnOldRelic (unregistered) in reply to usitas
    usitas:
    That still doesn't explain what a MERLOCK is...
    A murloc is a ******** from ***** of ******** that ***** in the ***** and ******* you when you get close.
  • (cs) in reply to Jay
    Jay:
    Crash Magnet:
    Then why not get rid of the name and password requirement and just ask for their email address? Is vehicle preference really such a sensitive bit of information?

    Apparently you don't live near a GM factory. If you did, you'd know that having a vehicle preference that is NOT GM results in making you a social pariah far worse than if you admitted to being a pedophile or a terroist-sympathizer. If you actually OWN a non-GM car, you are liable to find it routinely vandalized.

    As part of their restructuring, GM should have made plans to build a factory in every town in America. That would have markedly improved their market share.

  • (cs) in reply to ullamcorper
    ullamcorper:
    frits:
    F*** *FF *** F****N* *SS**LE

    Fret iff not finding assmole?

    That's great. I have a F***N captcha quoting me.

  • (cs)

    Sooo... um everyone else on here is clearly a redditor. Why did I just learn about it a month ago... So many hours not could've wasted.

  • Jack (unregistered)

    On our systems, the password actually is **************. (We are required to use 14 chars for security.) Anyway, when someone reads the source code and sees the stars, they assume it is masked and replaced by the real password somewhere else. But after hours of trying to follow our convoluted logic, they give up.

    This is known as "hiding in plain sight". So far, it's working.

  • (cs) in reply to usitas
    usitas:
    java.lang.Chris;:
    Jaime:
    Why does a middle tier project even reference System.Windows.Forms???? That's so much of a WTF that Microsoft added a new feature to Visual Studio 2010 called "Layer Validation" that allows the system to fail builds when stupid things are referenced.

    I wish I could find an off the shelf Java tool or IDE plugin that does that kind of layer validation. Instead, I have a script that looks for imports from JDBC and GUI related packages or JDBC and Servlet (actually a framework abstraction package, but the principle is the same) packages in the same class.

    This is why you set hard application boundaries so that the DB layer is safely protected in its own jar

    True. But the layer validation feature is designed to protect against developers that don't understand the application boundaries and tend to violate them when it is convenient. This is common with contractors and newbies.

    It's all well and good to say that you set application boundaries. It's another thing to enforce it.

  • sino (unregistered) in reply to Herby
    Herby:
    After we are done playing with wheel of fortune, I wonder why (is there ay other type of wonder) ...
    Ay: who, where, what, when, how, if...
  • PoPSiCLe (unregistered) in reply to Anon
    Anon:

    MIN_USER_LENGTH is not the user's height, unless horizontal, if you know what I mean.

    For once I actually lol'ed - and by Anon, none the less... I am sad

  • Anti-virus is a scam (unregistered)

    Shoulder-surfing by malicious users isn't the problem. Malicious users will just install a keylogger when you go to lunch, etc.

    The problem is when you're with a non-malicious user, and they happen to see your password. You may say that it's hard to memorize, but that's bullshit: If you see random words flying up every now and then, it's impossible not to both notice and memorize at least a partial password.

    At least 90% of security is about protecting against non-"malicious" users.

  • Snarf (unregistered) in reply to frits
    frits:
    F*** *FF *** F****N* *SS**LE
    FEND OFF THY FLAMING OSSICLE
  • BSDPwns (unregistered)

    What the hell? Who posted this and said "Oh lol, when it prints that messages box"????? YOu are now fired because that will NEVER happen

    "if (value != null && value.Length < User.MIN_USER_LENGTH)"

    So if the string is LESS than the ALLOWABLE length which is at minimum 0, and not typing anything results in a length of 0 that condition will never occur.

    Thanks for playing though.

  • (cs) in reply to snoofle
    snoofle:
    Yes, you won the car, but the password to start it is "*********".

    Not a problem! I can't drive anyway (never have). I don't have any depth perception.

    //TODO: Insert preferred witticism here ...

  • (cs) in reply to AnOldRelic
    AnOldRelic:
    usitas:
    That still doesn't explain what a MERLOCK is...
    A murloc is a ******** from ***** of ******** that ***** in the ***** and ******* you when you get close.

    A murloc is a creature from World of Warcraft that lives in the water and pummels you when you get close.

    Also, a murloc is considered to be found amusing by persons 13 and younger when utilizing the trade chat area of the game.

    However, from the spelling "Merlock" I would assume that rather than the fictitious creature from the overly addictive MMORPG World of Warcraft that you were referring to the mermaid warlock, the half-brother of the witch mermaid in the Disney classic "The Little Mermaid"... that clear everything up?

  • (cs) in reply to frits

    Can I buy a ☺?

  • Anon Too (unregistered) in reply to Anon
    Anon:
    java.lang.Chris;:
    On a related note, we had an interesting customer complaint about a password recently. The guy was trying to log in, and sent us a profanity laden email when he couldn't. For reasons known only to my predecessor, passwords are stored in our database in plain text rather than being hashed, so I took a look at this guys password in order to attempt a log in. His password was:

    ●●●●●●●●●●●

    It turns out he'd cut and pasted his favourite password from a web form in his web browser, which had been set to store passwords.

    Unfortunately our system uses plain test passwords too, except this is by design. It turns out people in the motor trade are too fucking retarded to remember a password, even if it's the same as their name, and they call up constantly wanting their password. We tried implementing hashed passwords with two step reset password setup, but their knuckles dragging across the keyboards meant it didn't work. In the end we went back to the original system that makes me cry when ever I look at it. For what it's worth, we don't store anything other than their name, email address and vehicle preferences.

    Having worked with the motor trade as well I could not agree more. Bunch of Luddites.

  • hunter3 (unregistered)

    i work in an autorepair centre. all passwords for everything business-related are stored in a plaintext file on the desktop of the reception PC. oh, and every file on every PC is available via the network. the unsecured wireless network.

  • (cs)

    But, my password for everything is ******** Except, of course, all my online banking. For that I use a more secure password: **************

  • SR (unregistered) in reply to usitas
    usitas:
    That still doesn't explain what a MERLOCK is...

    It's a hairpiece for the nether regions, isn't it?

  • (cs) in reply to SR
    SR:
    usitas:
    That still doesn't explain what a MERLOCK is...

    It's a hairpiece for the nether regions, isn't it?

    It's kin to that.

  • Andy Lynch (unregistered) in reply to java.lang.Chris;

    I can think of a couple for Java; IntelliJ IDEA's dependency structure matrix can enforce these kinds of rules; there is also another (enterprisey) tool, I think it's called Lattix.

  • (cs)

    Lotus Notes.

    Never understood their weird hieroglyphs and XXXXXXXXXXXXXXXX or whatever happens when you type your password!

  • (cs) in reply to Gabelstaplerfahrer
    Gabelstaplerfahrer:
    Lotus Notes.

    Never understood their weird hieroglyphs and XXXXXXXXXXXXXXXX or whatever happens when you type your password!

    First of all, Lotus is almost a worse piece of software than windows. There is no security AT ALL, it is slow, thanks to networked virtualized java virtualization and I dont know how many layers of virtualization to just show plain text and then crash.

    That being said, about the mystery of XXX, I think it displays three X's for each char you input, so the person looking over your shoulder (or the well known duck) cannot easily count the number of chars in your password.

  • Brendan (unregistered) in reply to DjFm

    Hi,

    DjFm:
    That being said, about the mystery of XXX, I think it displays three X's for each char you input, so the person looking over your shoulder (or the well known duck) cannot easily count the number of chars in your password.

    That's why, when I'm looking over someone's shoulder I look at their keyboard. For secure environments, set your keyboard mapping to "Dvorak"...

    -Brendan

  • PITA (unregistered) in reply to SR
    SR:
    usitas:
    That still doesn't explain what a MERLOCK is...

    It's a hairpiece for the nether regions, isn't it?

    No, that is a merkin.

    http://en.wikipedia.org/wiki/Merkin

  • PITA (unregistered) in reply to frits
    frits:
    SR:
    usitas:
    That still doesn't explain what a MERLOCK is...

    It's a hairpiece for the nether regions, isn't it?

    It's kin to that.

    Heh - didn't see this before my other post.

    http://en.wikipedia.org/wiki/Merkin

  • Jo Diggs (unregistered)

    Sounds pretty reasonable to me dude. Well done.

    Lou www.vpn-privacy.us.tc

  • PITA (unregistered) in reply to Gabelstaplerfahrer
    Gabelstaplerfahrer:
    Lotus Notes.

    Never understood their weird hieroglyphs and XXXXXXXXXXXXXXXX or whatever happens when you type your password!

    Actually, they are not x's, but 'greater than' and 'less than' charachters side by side (i.e.- '><><><><><><><><><><><><')

  • Anonymice (unregistered) in reply to Anonymous
    Anonymous:
    So wait, their business objects return "*******" for the password property? How does calling code work with the real value? Any why the hell is there GUI code (System.Windows.Forms.MessageBox calls) in the business objects? And is that a changed event? Why do you need a changed event if the changed value is a big secret that can't even be exposed to other parts of the code? I guess what I'm asking is, in summary, what on Earth is this steaming pile of crap?! Why create an n-tiered application if you're just going to piss all over the fundamental principles therein?
    Mostly just to annoy you. I think it worked.
  • AJ (unregistered)

    return "Brill*nt";

  • PB (unregistered) in reply to Jaime

    Yes, but that would then require somebody to have architected this system, set that up and actually be running automated builds (which judging from the code, might not be too likely).

  • (cs) in reply to DjFm
    DjFm:
    First of all, Lotus is [strike]almost[/strike] a worse piece of software than windows. There is virtually no security AT ALL, it is slow, thanks to networked virtualized java virtualization and I dont know how many layers of virtualization to just show plain text and then crash.

    That being said, about the mystery of XXX, I think it displays three X's for each char you input, so the person looking over your shoulder (or the well known duck) cannot easily count the number of chars in your password.

    FTFY (or, at least tried. There's only so much one can do.)

    Fortunately, the hieroglyphs start after the third character is pressed. At any keystroke, there's 2-3 characters that will generate the same next hieroglyph. However, I haven't encountered any two character sequences that'll give the same pair of glyphs from any point.

    That having been said, it's still not too horribly difficult to deduce the password from the sequence, and it's pretty easy to count the number of hieroglyph changes (of course, every so often, the hieroglyph doesn't change on a keypress...)

    But, anyway, you can actually have some semblance of security if you have Lotus Notes encrypt your mail file. Before too long, it'll corrupt it, and then nobody can get anything out of it.

  • Mike (unregistered) in reply to ullamcorper
    ullamcorper:
    frits:
    F*** *FF *** F****N* *SS**LE

    Fret iff not finding assmole?

    Why would you fret if and only if you didn't find an assmole?

Leave a comment on “Don't Pass The Password”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article