196
"TIP: You can use special characters..." "Wait, no, not those, they would break our software." (i.ibb.co)
submitted 19 hours ago by to c/softwaregore@lemmy.world
40 comments fedilink hide all child comments
 

https://konto.zssk.sk/zk/new#step1

Also, it only seems to show "Strong password" if any of these characters is used: !@#$%^&*, and not other special characters.

you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 8 hours ago* (3 children)

My guesses would be that either:

  • They conducted an employee survey where someone admitted the company name being a substring of a password they use.
  • They used some rudimentary bruteforce methods which matched salted registers or logins (say "Company name123456".)
  • Instead they meant that it is possible to create passwords with the company name in it, but transmitted it poorly.
  • Some of the passwords are unsalted.
  • The passwords are logged somewhere else.

It goes without saying that if they found a vulnerability with the hashing or salting, it should be highlighted on its own, and in any case it wouldn't do damage to ask them directly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 hour ago

    Thanks, it’s probably a combination of the above or even all of them

    And like another user shared, they may just be idiots

    I just wanted to confirm, there must be plain text databases, they got access to, maybe from some of the less secure systems, on the shop floor or wherever that may have unsecured protocols (they’re inside the corporate network, not directly connected to the internet)

    But I’m going with idiots

  • permalink
  • fedilink
  • source
  • parent