r/pcmasterrace • u/PewPewToDaFace • 17h ago

News/Article '123456' password was all a hacker reportedly needed to expose over 8 million people's personal data

https://www.pcgamer.com/software/security/123456-password-was-all-a-hacker-reportedly-needed-to-expose-over-8-million-peoples-personal-data/
2.3k Upvotes

98% Upvoted

153 comments sorted by

View all comments

Show parent comments

8

u/InterstellarReddit 14h ago

Yes but that isn’t a good practice cuz what if your security engineer gets compromised.

build your security in silos of power.

For example, I have the ability to connect to any customer’s instance and look at their data.

However, for me to connect to, I have to submit a quick request takes a second and my manager has to approve it, then I have global enterprise access for 8 hours

So your workforce still has all the global admin access needed to do their job, except you silo it off into small windows of power that way if you ever compromised it’s really just a regular account.

Think like sudo.

You’re really just a normal person until you invoke sudo and then you need another layer of approval wether it’s password or something to proceed

1

u/Xeadriel i7-8700K - EVGA 3090 FTW3 Ultra - 32GB RAM 14h ago

i know, but it seemed like most do it anyway. well anyway, that explains the confusion. nvm then

4

u/InterstellarReddit 14h ago

Yeah I’ve been a consultant for 12+ years 20+ in dev ops. Fam not one company follows best practice

Always tell people, nobody knows what they’re doing. Everybody is just figuring it out as they go along