r/pcmasterrace • u/PewPewToDaFace • 15h ago
News/Article '123456' password was all a hacker reportedly needed to expose over 8 million people's personal data
https://www.pcgamer.com/software/security/123456-password-was-all-a-hacker-reportedly-needed-to-expose-over-8-million-peoples-personal-data/469
u/Appy_Ace 15h ago
Can't believe security policies are allowing users to set "123456" as their password in this day and age.
223
u/InterstellarReddit 15h ago
Security is an illusion. We’re a publicly reported company and I found someone exploited a method through registering through a learning course to access our internal resources and start scanning etc
They took 2.5 months to reach out to me on my submission to the security team. We’re a 10++ billion dollar company.
35
u/TowelTraining4324 15h ago
I’m curious on the vector if you don’t mind a follow up question. Was the learning management system exposed to the internet for contractors or other individuals who are / were not on the internal network and needed to complete training?
40
9
u/bobsim1 15h ago
Thats a it security problem that should be fixed.
26
u/InterstellarReddit 15h ago
Even if it’s not fixed reaching out two months later let’s me know it’s a joke
-4
u/Xeadriel i7-8700K - EVGA 3090 FTW3 Ultra - 32GB RAM 14h ago
I mean to be fair fixing it has a higher priority than replying to you
20
u/InterstellarReddit 13h ago
How can you fix something if you don’t have the information to fix the breach? They have to reach out, contact the reporting party, understand how the breach occurred, and what happened, and from there take action.
-6
u/Xeadriel i7-8700K - EVGA 3090 FTW3 Ultra - 32GB RAM 13h ago
It sounded like you gave them that info when you reported it lol.
I was just trying to be generous as that does happen, especially with important stuff like this.
8
u/InterstellarReddit 13h ago
I gave them the information for what I found; however, they don’t have access to the application as an administrators to see the information.
Processes a reach out, I provision a temporary super admin account for them, and they do their research and review.
Security doesn’t have global access to everything, unlike what people lead you to believe.
controlled company, even security has to request access to do a security review
-8
u/Xeadriel i7-8700K - EVGA 3090 FTW3 Ultra - 32GB RAM 12h ago
uhuh. In the few companies ive seen they just have global access lol.
6
u/InterstellarReddit 12h ago
Yes but that isn’t a good practice cuz what if your security engineer gets compromised.
build your security in silos of power.
For example, I have the ability to connect to any customer’s instance and look at their data.
However, for me to connect to, I have to submit a quick request takes a second and my manager has to approve it, then I have global enterprise access for 8 hours
So your workforce still has all the global admin access needed to do their job, except you silo it off into small windows of power that way if you ever compromised it’s really just a regular account.
Think like sudo.
You’re really just a normal person until you invoke sudo and then you need another layer of approval wether it’s password or something to proceed
→ More replies (0)1
u/TeamWorkTom 4h ago
Reading comprehension not a strength of yours?
Missed the part where the person your commenting to is literally the one that knows the problem and solution?
Lmfao. Are you a bot?
30
u/Fluboxer E5 2696v3 | 3080 Ti 14h ago
They make you put a letter, a number, a special character, a Big Letter and a racial slur in your password (which will still get bruteforced in a minute because length increase is stronger) while they themselves are using 123456
16
u/XorpusThePorpoise 12h ago
My work, which is an international company worth over 100 billion, stores passwords in plain text. I know this because one time I had to have my password reset, and instead of resetting it for me they sent me my password in an email.
8
u/Alexandratta AMD 5800X3D - Red Devil 6750XT 10h ago
...I work in a damn Credit Union and our password policy requires we can't even use English words or make symbols to make words.
Acronyms or pneumatic devices to remember our passwords is all that is authorized.
Admin accounts have randomly generated passwords at unknown intervals - I have to login with my main password, do 2FA, and only then can I get my temp admin password - which I do not actually know.
These aren't hard cyber-policies to implement.
3
-1
u/MjrLeeStoned Ryzen 5800 ROG x570-f FTW3 3080 Hybrid 32GB 3200RAM 13h ago edited 13h ago
Symbol+capital+number etc is so a human can't guess it. Those characters mean nothing to a computer, the only thing that matters is entropy and the only thing that makes it go up is a longer password.
An 8 character password has a ceiling of 53 bits of entropy. A 12 character has almost 80 bits of entropy. 53 bits can be brute forced in as little as 8 days with modern CPUs. 80 bits takes decades, possibly over a century.
With over 10 characters in a password, trying to brute force is applicably no longer feasible. That's why phishing/social engineering is the go-to for infiltration.
3
u/LovelyKestrel 6h ago
What I don't understand is why do companies allow the number of tries needed for brute-forcing? Why don't they stop all attempts for 10 seconds after 3 failures (or even 1. A human who made a mistake probably wouldn't notice a ten seconds delay, but it would slow a brute-force attempt enough to make it impractical
4
u/Lewinator56 R9 5900X | RX 7900XTX | 80GB DDR4 4h ago
Brute forcing a live system is almost never feasible. It's far too slow.
The risk is from a leaked database which a malicious actor could then run through a rainbow table to see if any hashes match. Realistically though with modern hashing methods like argon2id with salting, you can't brute force hashes as it's just too slow or too memory intensive.
Unfortunately a good number of companies still store passwords in plain text. If I recall one of my banks used plain text passwords (as much as they tried to deny it when I brought it up) because they asked for specific characters from the password when logging in rather than the full password. Obviously anyone with any computing knowledge knows it's impossible to check specific characters of a password is hashed. I'm no longer with that bank.
4
u/nullptr777 Linux 7h ago
This is an incomplete understanding of password security and entropy. Length alone is not sufficient without randomness.
For example,
n1f@L$sLK%0aj!is a better password thanILoveMyDogNamedFetch!777. Even though the latter is significantly longer, it has much less entropy.Susceptibility to brute force also depends, quite heavily, on the KDF used. Any modern GPU can run trillions of guesses per second with PBKDF2, and maybe only a few hundred per second with argon2id.
1
u/Mammoth-Physics6254 3h ago
It's much harder to crack a password with symbols because most cracking software isn't trying go through Quadrillions of combinations instead they just scrape details from previous breaches and common dictionary words and combinations. No one is throwing up a supercomputer to access your bank account or steal your information unless you're a billionaire or something.
31
u/_somebod 5h ago
Security policies are the reason people use passwords like this.
Have a password like h86&§|bi-8||°vwlf69™ and memorise it, no one will ever guess it and they make you change it after X months.
Then comes H96bt8G! But then you forget what it was so you have to reset it.
Then you do either ABC123! Or you do a secure password and write it down on a post it note and stick it to the computer.
Change password after X days is the single worst "security" policy ever. All it does is encourage people to be less secure.
4
u/Mammoth-Physics6254 3h ago
Have one long password with symbols and numbers and a password manager. Even if your password manager gets breached(very rare Bitwarden has never had a large scale data breach as far as I know) it's much easier to change your password for the one site as opposed to dealing with breaches for individual sites. The biggest security risk is that someone gains access to to your account details from a site with poor security and access your email/bank/site with your credit details. You can set a password manager up in like 5 minutes.
1
u/legit_doom_scroller 3h ago
Bitwarden is amazing. I pay them everything I can pay. My whole family uses it. We have a shared directory of passwords we all use and our own passwords are private from each other. I looked the other day, and me, just me, I have 348 passwords stored. Who the hell could remember that without them all being the same?
1
u/elaborateBlackjack 1h ago
That's exactly what I do. I don't understand why people don't do this... Just remember ONE secure lengthy password that's it. ONE
6
u/Lewinator56 R9 5900X | RX 7900XTX | 80GB DDR4 4h ago
Yep, this is something that annoys me when places do it.
Like, my password is secure, it's a random string of characters, but I will never forget it. A silly security policy that requires I change it after 2 months doesn't make the system any more secure, it just makes me think up a new password, and likely note it down somewhere, and then 2 months later, I need another new one.
A secure password stays secure forever. Regularly changing a password doesn't inherently improve security of a system, if snything, it reduces it by pushing users to use simpler passwords or to write them down.
2
u/penisandorvagina 3h ago
Brother just use a password manager, it's easier than making excuses.
3
u/AdBrief446 3h ago
It’s the password I use to login to my work laptop that sucks for me, because I can’t copy and paste it from my anywhere and they make me change it all the time, so I keep it short and easy to remember. everything else I just use a password manager
1
2
u/Maleficent_Onion_822 3h ago
You can usually add something memorable to a base PW e.g., 3q26*H96bt8G!
1
u/Initial-Beginning853 3h ago
I imagine this is more to be compliant and meet RFPs than a certainty that we should be rotating credentials.
We can somewhat blame regulation/market expectations here.
1
u/DEADB33F 2h ago
I don't disagree ...but why not have a secure password that remains constant and then just append a number to the end which is the month it was last changed.
1
u/pementomento 3h ago
Seriously. I just change the last digit of my password when faced with frequent changes.
8
u/AdLatter3755 9h ago
It’s the same kind of password an idiot uses for their luggage
https://giphy.com/gifs/xT0GqJfdLcrcpSbZf22
2
u/Nearby_Passenger1520 RHEL 13h ago
This is what happens when every "IAM Engineer" on tiktok shills the stupid idea to others.
1
1
u/AnywhereHorrorX 12h ago
They've just disabled password expiration for their admin accounts and have been using 123456 since 1995 everywhere.
1
1
1
1
u/legit_doom_scroller 3h ago
Isn’t it wild? I have a friend who works in IT for a bank. They have 3 passwords. Each is 12 characters, random numbers, letters, and symbols. They are not permitted any password management software, are expressly forbidden (lol. Good luck, but it comes with threat of immediate termination) to record it on paper or digitally, and the password changes every three months.
My buddy has several strategies to memorize them.
For the rest of us? Ehhh. Bitwarden.
204
u/Sailor51PegasiB HTPC: Ryzen 7 5800XT | 32GB PC3200 DDR4 | RTX 5070 15h ago
That’s the kind of combination an idiot would have on his luggage.
83
17
14
11
u/Darkpriest667 5950X 6900XT Linux 12h ago
The fact this is not the top comment is embarrassing. Do better reddit, this was a layup lol
61
u/PikachuuuCSGO it has lights and goes BRRRRR! when I turn it ON! 15h ago
That's why I use "1234567". It's much harder to guess.
29
u/Random_Guy_47 12h ago
How is this possible when every account I ever make with any company ever always demands a password that requires: uppercase letters, lowercase letters, numbers, symbols, the name of your firstborn and a blood sacrifice?
How the fuck do they not apply the same password requirements to their employees as they do to their users?
38
u/Adventurous_Ad3534 15h ago
My employer tells us to use complicated passwords and we go through monthly training to help us prevent being victims of phishing. Yet they use log in passwords as simple as "password". 🤦♂️
12
u/TRUEequalsFALSE 9950X3D | Sapphire 9070XT | 64GB DDR5 15h ago
C'mon people. It's 2026. What are you doing? You should know better.
15
u/Pitiful_Objective682 14h ago
Truth is with sufficient attempts many password cracking attempts will succeed. You need to slow attackers down with rate limiting, ip bans etc.
8
4
7
u/Clippy_4060 14h ago
Zero days, special tools, exploits, hackers use to combat cybersecurity teams, but in reality you can do the same thing with something as basic as a phishing email or password guess.
6
u/Cletus_Crawford 8h ago
Mine makes me put in a symbol so it's safe. 12345!
1
u/Ordinary-Cake8510 Intel 14900K | 5060 | 64gb DDR5 7h ago
Mine is 654321! Since I only have to press shift at the end!
4
7
u/Piltonbadger RYZEN 7 5700x3D | RTX 4070 Ti | 32GB 3200MHZ RAM 15h ago
Never underestimate the human capacity for stupid.
4
5
5
u/Fantastic_Key_8906 13h ago
I've worked at many workplaces where the password for their entire intra-net is Password123 or the company name+123. Anyone can get in. I even explained this to some managers once and the day after they changed it to like asswordp123. Its so fucking stupid.
2
u/Signal_Second_82 14h ago
That's why we have to add all the bullshit special characters to keep them guessing but the only one that's guessing is me
2
3
u/Short_System_4833 14h ago
Eh, it’s just a entire countries social security database. Nothing to worry about
/s
2
2
u/TheHomieAbides 9700x | 9070xt 14h ago
I use that password!
When registering for sites with made-up info and a temp email.
2
2
1
u/Robborboy KatVR C2+, Quest 3, 9800X3D, 9070XT, 64GB RAM 15h ago
I'd like to see if the password was changed to that recently.
1
u/ioncloud9 i5 14600K RTX 3070TI 32GB DDR5 15h ago
Why was this database secured with a password at all? It should’ve been a certificate, a security key, or a passkey.
1
1
1
1
1
1
1
u/Warcraft_Fan Paid for WinRAR! 2h ago
Still a better password that what that idiot president used as his luggage combination or the idiot King for the air shield.
1
u/_jimmythebear_ 32m ago
Konica Minolta printers default admin password was 12345678 in the day, but they updated it to 1337 haxor 1234567812345678 100% true.
1
u/TheMundar Cable management is a sin 15h ago
That's the kind of PW you use for a used when you need in game server that only your friend knows about and you just want some manner of roadblock just incase.
Yeeesh, that is a quite the failure
1
1
1
1
1
1
u/New-Alfalfa-2989 13h ago
No matter how much companies or agencies spend on cybersecurity, there is always some fuckin idiot with a very shit password somewhere that is trivial to brute force, or willing to click on just the right link in a phishing email.
1
1
1
1
1
1
1
1
u/MrDeeJayy Ryzen 7 5700X | AMD RX 6700 XT | DDR4-3200 32GB 4h ago
123456! That's crazy! That's the kind of combination an idiot would use on his luggage!
0
u/Nickk-Chibi 12h ago
12345–that’s amazing I got the same combination on my luggage! Anyone got the reference?
0
-1
u/iheartzigg 7900 XTX | 13700k Constant Crashing 11h ago
I do use passwords like 123.. and qwerty, and if those accounts are hacked I could not give less of a shit.
They have such passwords precisely because I'm forced to use an account for whatever reason.
0
0
0
0
u/firedrakes 2990wx |128gb |2 no-sli 2080 | 200tb storage raw |10gb nic| 14h ago
wow this topic get reported a few times a year
0
u/GAP_Trixie Ryzen 5950x, RTX3090, 64GB DDR4 RAM 11h ago
Do these companies not run audits for their systems?
0
u/try_again_22 7h ago
I work at a company that deals with sensitive data all the time and every password we use is some shit like this
0
u/chrlatan AMD R7 9800X3D | RTX 5080 | Full Custom Waterloop 7h ago
Welcome to another round off….The Weakest Link.
.
0
u/MorbotheDiddlyDo 6h ago
That's what the company set it to per the terms of the agreed upon backroom deal to sell the data.
At some point negligence regarding data needs to be treated as malicious with intent to distribute. Fines dont cut it if they profit more.
-1
-1
u/wilberfarce i5-12400 | RTX 4070 | 64GB DDR4 11h ago
Look, I’ve watched Hackers. If they had used sex, love, secret, and God they’d have got a lot more.
-4
u/NamesNotNeededToWork PC Master Race | 7800X3D | 7900XTX | 32GB DDR5 5h ago
Are people still not using a locally stored password manager with random generated passwords? In 2026? Crazy.
1.1k
u/DyslexicOrxy 15h ago
The trick is to add the 7890 at the end, it’s unhackable.