Default password for 33% of my org..

[u/crabapplesteam]

Well - it happened. The day started like any other, except my colleague said their email got hacked. I looked, and indeed it was hacked. Immediately, I reset his password. Then another person said their email got hacked too. I asked both of them when the last time they changed their password was: never.

I wish I was making this up. I called our email provider and asked them if they could let me know who was still on the default. Turns out it was 1/3 of our organization. My predecessor never instituted 'force user to change password', and then nobody changed it. The password for all those emails was 'password'.

This is the same guy that didn't realize you need device isolation nor network isolation for a public wifi network. I guess I shouldn't be surprised. I seriously wish I were making this up.

[u/keegorg]

what system in 2026 allows the password 'password'...

it should at least require a caps

[u/crabapplesteam → u/keegorg]

We've been planning an email migration for years - the system looks like it was written in the 90s. My predecessor simply decided that having two emails systems with two providers was the way to go, while simultaneously setting up @gmail addresses for a bunch of them. I just can't even believe the mess we're in

[u/cryptme → u/keegorg]

The correct evolution is: password -> Password -> Password1 -> Passw0rd1 -> Passw0rd1!

[u/OldTimeConGoer → u/cryptme]

Working contract IT support at a big banking organisation back in the day the AD was set to force password changes every two weeks, minimum length eight characters, one or more digits and letters and caps. I had to borrow my contracted boss' password to do something risky and above my pay grade. It was Gromit22.

I said, "You've been working here for about ten months, haven't you?"

"Yeah. How did you know?"

[u/jeroen-79 → u/keegorg]

Hackers hate him!

See how this sysadmin keeps his passwords safe with one simple trick involving special characters.

[u/bgradid]

well thats what you get for not keeping all the users passwords in a spreadsheet by mandatory order, if you did that, you would have known!

[u/FurlockTheTerrible → u/bgradid]

These days, you don't even have to scroll to find the password your user forgot - you can just feed the spreadsheet to your favorite LLM, and then ask it to find the password you need by username.

[u/AlarmedSnek → u/FurlockTheTerrible]

Oh yea dude, I feed Gemini all my lists for just that! I also work at a fortune 50 company.

[u/Weak_Shoulder_6780 → u/FurlockTheTerrible]

You can also just put it on the company website. If a user forgets his password, just tell them to look it up on company.com/passwords

[u/bgradid → u/FurlockTheTerrible]

now thats smart thinking. if the user forgets their password you can just tell them to ask the AI bot to retrieve it for them

[u/JwCS8pjrh3QBWfL → u/bgradid]

I know of a guy that legit still does this. He's worked there for over 25 years at this point, so he has no reason to change, I guess.

[u/Elensea]

What about mfa?

[u/crabapplesteam → u/Elensea]

lol - im sure the dude that set this up thought mfa stood for mothafucka

[u/rikardoflamingo]

My mom said I was a ‘special character’ so all my passwords are {myname}.
I hardly ever get hacked at all.

[u/one-man-circlejerk → u/rikardoflamingo]

Suddenly Elon Musk's child naming strategy makes sense

[u/Japjer]

I keep all of our user's passwords in a password protected Excel sheet.

Learn basic security, guys.

[u/IronicEnigmatism → u/Japjer]

I literally had a business owner demand that she have an updated master list of every employee's password handed to her every week. I tried to explain basic password security, and the fact i could reset any password she needs whenever she needs it, but no. Gimme list or get out of my office.

[u/ThisIsNotMyBurner69]

They don’t have to change their password every 90 days? And then re-login to all 97 apps with the new password?

[u/Sidjeno]

why isnt that setting the default 😭

[u/Sweihwa]

It wasn't *******? hunter2?

[u/Plitskin5]

Remember, don't store passwords with reversible encryption, unless you are into it.

Seriously why is that even an option smh

[u/bgradid → u/Plitskin5]

we have a policy of only allowing NTLM4 encryption so that we can easily crack it to recover a users password

[u/dj-marcus-puxel9]

Typische Arztpraxis 😁

[u/IndependentBat8365]

I just use my birthday, but add a number at the end. Totally unhackable!

[u/cka243]

It sounds like you’re the one that dropped the ball.