# Our "security" is so good, nothing fucking works anymore **URL:** \ **Category:** The BBQ Pit\ **Created:** [November 13, 2019, 4:17pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368 "2019-11-13T16:17:27Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Kobal2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kobal2/32/20_2.png) [@Kobal2](https://boards.straightdope.com/u/Kobal2)\ **Post date:** [November 14, 2019, 6:01pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/21 "2019-11-14T18:01:31Z")
> [@Hermitian](#): > > But doesn’t just about every system lock you out after about 5 tries anyway? So why is brute-forcing even a concern? I’m not \*super \*versed in cybersec or password breaking methods, but from what I understand many automated methods are based on attempting millions of log ins in parallel at the exact same time, thus pre-empting the “consecutive tries” locks. > [@](#): > > On another topic, I was once singing into a government system and one of the requirements was that your password had to be EXACTLY 12 characters. I can sort of understand a minimum, but making an exact requirement seems counterproductive. At least the hacker knows what length he needs to guess! Yeah, that doesn’t intuitively feel very helpful. Can actual experts weigh in ? **Manson** , you seemed to indicate that was your line of work ? ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [November 14, 2019, 6:17pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/22 "2019-11-14T18:17:22Z")
> [@Hermitian](#): > > On another topic, I was once singing into a government system and one of the requirements was that your password had to be EXACTLY 12 characters. I love singing passwords! My favorite is 1877kars4kids 🙂 > [@Kobal2](#): > > Yeah, that doesn’t intuitively feel very helpful. Can actual experts weigh in ? **Manson** , you seemed to indicate that was your line of work ? My guess is the person reading the requirements during development screwed up, or the person making the policy screwed up. However, thinking about it, I seem to remember some time in my past that a password had to be exactly 8 characters, but I’m racking my brain as to the reason - there was an actual reason, I just can’t remember. It might have been because the app was old, and only had storage for 8 character passwords, and later bolted-on security policy required AT LEAST an 8 character password which only left 8 character passwords as valid. Perhaps the 12 character case was similar. ---
**Author:** ![Kobal2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kobal2/32/20_2.png) [@Kobal2](https://boards.straightdope.com/u/Kobal2)\ **Post date:** [November 14, 2019, 6:36pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/23 "2019-11-14T18:36:46Z")
> [@Slash1972](#): > > I love singing passwords! My favorite is 1877kars4kids 🙂 Well that doesn’t seem right, it doesn’t have capitals or special chars. #END totally\_missing\_the\_joke(); ETA : also, earworm now. I’ll hurt you IRL. ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [November 14, 2019, 7:06pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/24 "2019-11-14T19:06:12Z")
> [@Slash1972](#): > > I love singing passwords! My favorite is 1877kars4kids Damn you manson1972. :mad: ---
**Author:** ![Kobal2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kobal2/32/20_2.png) [@Kobal2](https://boards.straightdope.com/u/Kobal2)\ **Post date:** [November 14, 2019, 7:43pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/25 "2019-11-14T19:43:15Z")
(A propos of nothing, I just realized my preferred method was essentially a reverse-mnemonic. Instead of coming up with a memorable phrase/acronym to help remind yourself of various amounts of arcane information, you’re creating arcane information out of a memorable phrase. Neat, huh ? Y’all carry on.) ---
**Author:** ![susan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/susan/32/17537_2.png) [@susan](https://boards.straightdope.com/u/susan)\ **Post date:** [November 14, 2019, 8:23pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/26 "2019-11-14T20:23:07Z")
> [@Broomstick](#): > > This isn’t _entirely_ new - back in the 1990’s when the company I worked at was using the internet more and more the IT department put a porn filter on the web brower/e-mail/etc. > > The problem? My department was _medical research_ doing a project on _ **breast** cancer_. Yep, EVERYTHING blocked. Howls from the researchers. Management meetings. > > The IT department’s answer? “Can’t you use words other than “breast” and “mammary”?” > > Uh, no, not really, not when you’re searching for information on _breast cancer_ in the published literature where literally all the titles and keywords were things like “breast” and “mammary”. > > Eventually something was sorted out so our department, at least, could search on terms like “breast” (and other “naughty” body parts). > > But I suspect it’s only gotten worse. Indeed. In that era, I was a university coordinator for lesbian, bisexual, gay and transgender students. The university’s internet settings blocked “lesbian,” “bisexual,” and “transgender.” ---
**Author:** ![Miller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/miller/32/481_2.png) [@Miller](https://boards.straightdope.com/u/Miller)\ **Post date:** [November 14, 2019, 9:05pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/27 "2019-11-14T21:05:27Z")
At work, we use a lot of off-the-shelf, 3rd party software. A lot of this software doesn’t have great documentation, so our devs often have to go to message boards to get answers to problems they run into during implementation. Often, this is explicitly how your supposed to get software support for this sort of thing. So, naturally, our security team decided to block posting to any sort of message board, because someone might post proprietary software code, or accidentally reveal details of an upcoming project. Which made it virtually impossible to get support for a lot of these projects, unless you were lucky enough to find someone on a forum who asked exactly the same question you wanted to ask. After about a month of this, security was convinced to allow a whitelist to allow certain devs to post on message boards again, but only those that really, really needed it. About two months later, the whitelist included very nearly every person in the company, and they finally junked the rule altogether. ---
**Author:** ![Shodan](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@Shodan](https://boards.straightdope.com/u/Shodan)\ **Post date:** [November 14, 2019, 9:18pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/28 "2019-11-14T21:18:56Z")
One of my first jobs in IT was writing an algorithm to prevent people from using obscene words in their passwords. Pro tip: “what the hell difference does it make” is not a question a very junior programmer should ask. Neither is “where do I store the table of obscene words so nobody will see it and be offended”. On a related note, my phone wasn’t working, and nobody could call me because it didn’t ring, but went straight to voice mail. I IM’ed the helpless desk. Their first question was “what is your call back number?” And they couldn’t accept my cell number because it had to be a company-owned device. A company I worked at used to send out mass voice mails that the phone system was down. My favorite is still the web address we were supposed to go to if the Internet wasn’t working. Regards, Shodan ---
**Author:** ![Colibri](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/colibri/32/1841_2.png) [@Colibri](https://boards.straightdope.com/u/Colibri)\ **Post date:** [November 14, 2019, 10:13pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/29 "2019-11-14T22:13:07Z")
> [@Shodan](#): > > One of my first jobs in IT was writing an algorithm to prevent people from using obscene words in their passwords. Pro tip: “what the hell difference does it make” is not a question a very junior programmer should ask. I imagine it was because lot of passwords were variants on “fuckyouitdept123.” (I admit to have created passwords like that on particularly intrusive websites.) ---
**Author:** ![Colibri](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/colibri/32/1841_2.png) [@Colibri](https://boards.straightdope.com/u/Colibri)\ **Post date:** [November 14, 2019, 10:19pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/30 "2019-11-14T22:19:10Z")
I’m surprised no one has referenced [Mordac, the Preventer of Information Services.](http://wiki.urbandead.com/images/5/59/Mordac.jpg) ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [November 14, 2019, 10:25pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/31 "2019-11-14T22:25:26Z")
> [@Colibri](#): > > I imagine it was because lot of passwords were variants on “fuckyouitdept123.” (I admit to have created passwords like that on particularly intrusive websites.) At one job we had a timekeeping system that ran on a platform called “Penta”. (I assume, given how evil the software was, the developers worshipped Satan and it was short for “Pentagram”.) We required a password for that horrid system that was overly restrictive and I hated the software so much that every password was “Pentasux” with a number afterward. Anyway, who gives a shit what’s in a password? Proper security protocols would have you never sharing your password with anyone else in the organization anyway. Who are you going to offend, the domain controller? As long as it meets complexity requirements does it matter if the password is “J3sus!$L0v3” or “Ibl0wG0@t$”? ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [November 14, 2019, 10:26pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/32 "2019-11-14T22:26:50Z")
> [@Colibri](#): > > I’m surprised no one has referenced [Mordac, the Preventer of Information Services.](http://wiki.urbandead.com/images/5/59/Mordac.jpg) Haha, I had that exact same strip on my wall at my first IT support job back in the early 2000s. Especially because my boss would wear suspenders like that. 😃 ---
**Author:** ![susan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/susan/32/17537_2.png) [@susan](https://boards.straightdope.com/u/susan)\ **Post date:** [November 14, 2019, 11:13pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/33 "2019-11-14T23:13:53Z")
> [@](#): > > Ibl0wG0@t$ Jeez, now I need a new password :mad: ---
**Author:** ![Die\_Capacitrix](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/die_capacitrix/32/9_2.png) [@Die\_Capacitrix](https://boards.straightdope.com/u/Die_Capacitrix)\ **Post date:** [November 16, 2019, 8:09am UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/34 "2019-11-16T08:09:37Z")
Realized that my U.S. Global Entry is getting old, so I looked up how long it should last. 5 years, and it’s possible to renew it up to one year before it expires. As of this month, I am 4.5 years from the date I got the green light. So I go to the site. Nope, original Global Entry identification is no longer valid. I have to create a new one. And even though my U.S. Passport has only fields for Name and First Name, which is how I order plane tickets, Global Entry has fields for First, Middle and Last. I create the new account. Seems they changed something else. The expiration date is even later and now tied to my birthday, even though the original date of validity is no where need my birthday. So now my husband’s Global Entry and mine are not renewed on the same date, since our birthdays are not the same. At least they are the same year. We did have a system that did not recognize an initial 0 (zero) in the password. So anyone who changed their password to include an initial zero could never log in again. And we also had a system with an interesting feature. People would set their password to **password12** and the system would accept it. But when they input the password, it got truncated to **password** before being sent to the system. They could never log in again. ---
**Author:** ![Nava](https://avatars.discourse-cdn.com/v4/letter/n/da6949/32.png) [@Nava](https://boards.straightdope.com/u/Nava)\ **Post date:** [November 16, 2019, 9:21am UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/35 "2019-11-16T09:21:32Z")
> [@Die\_Capacitrix](#): > > And we also had a system with an interesting feature. People would set their password to **password12** and the system would accept it. But when they input the password, it got truncated to **password** before being sent to the system. They could never log in again. I’ve had that problem with sites that required me to enter my full name in order to reset my password. In the inmortal words of my dad: “no, my name is not too long. Your field is too short.” ---
**Author:** ![Broomstick](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/broomstick/32/246_2.png) [@Broomstick](https://boards.straightdope.com/u/Broomstick)\ **Post date:** [November 16, 2019, 9:42am UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/36 "2019-11-16T09:42:31Z")
I’ve had problems with sites that require a middle name or initial in the name field. I don’t have one. You can see the problem. ---
**Author:** ![Aspidistra](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aspidistra/32/3894_2.png) [@Aspidistra](https://boards.straightdope.com/u/Aspidistra)\ **Post date:** [November 16, 2019, 10:35am UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/37 "2019-11-16T10:35:35Z")
> [@Colibri](#): > > I imagine it was because lot of passwords were variants on “fuckyouitdept123.” (I admit to have created passwords like that on particularly intrusive websites.) If the IT department can \*tell \*that your password is fuckyouitdept123, then they deserve every letter of it ---
**Author:** ![DummyGladHands](https://avatars.discourse-cdn.com/v4/letter/d/49beb7/32.png) [@DummyGladHands](https://boards.straightdope.com/u/DummyGladHands)\ **Post date:** [November 17, 2019, 5:50am UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/38 "2019-11-17T05:50:37Z")
> [@Nava](#): > > I’ve had that problem with sites that required me to enter my full name in order to reset my password. > > In the inmortal words of my dad: “no, my name is not too long. Your field is too short.” I am so terribly sorry my Dad’s middle name does not have enough characters. Please suggest a solution. Assholes. ---
**Author:** ![Colibri](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/colibri/32/1841_2.png) [@Colibri](https://boards.straightdope.com/u/Colibri)\ **Post date:** [November 17, 2019, 6:09am UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/39 "2019-11-17T06:09:43Z")
Some years ago I had a job that required me to register as an official US government contractor. Although I’m an individual, I had to register as if I were a small business, and answer 35 pages worth of forms. Although I am the only “employee,” and am basically just a science writer, I had to answer questions regarding my policy on disposing of nuclear waste, and on equal opportunity hiring.:dubious: Since I reside overseas, I had to obtain an ID number from NATO.:smack: After a couple of years, they informed me my registration had expired, and I had to renew my registration. However, I had registered under my name without my middle initial, while I had obtained my NATO number using my middle initial. Although I tried repeatedly to reconcile the registrations, and called the help center, it proved utterly impossible to renew my registration. Fortunately I haven’t had any new government contracts. In the event I do, I’m sure I’ll be better off starting all over rather than trying to renew my former one. ---
**Author:** ![Bayaker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bayaker/32/3454_2.png) [@Bayaker](https://boards.straightdope.com/u/Bayaker)\ **Post date:** [November 17, 2019, 2:30pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/40 "2019-11-17T14:30:36Z")
> [@Lightray](#): > > I recently tried to arrange a Hold Mail with USPS, which I have done many times before. Denied. New security measures in place require you to register (i.e., give them your valuable data), and be verified. You can be verified via cell phone… but it wouldn’t accept my cell# as acceptable for verification, and there was no available information to be found on _why_ a cell# might be unacceptable. > > As an alternative, you can request a code be mailed to you within 10 working days, with which you can set up your Hold Mail. Of course, I was out of town by the time it arrived, so that was a big help. > > Couple weeks after I got the code in the mail, USPS sent me a helpful email because I’d used Hold Mail before, explaining that they were changing how it works. :eyeroll: The same thing happened to me about a week ago. An additional tidbit is that on the registration screen “phone number” is a required field, but below that is a box for “cell(maybe it was mobile) number” which is _not_ a required field. I didn’t fill that out because my cell is turned off most of the time and don’t want the USPS calling it anyway. I got to the Hold Mail screen and was informed about the necessity of my cell number for “verification”, and had to go back and update my profile to include it. Of course then my cell number was unacceptable to them for no given reason. Apart from getting a letter in ten days (I was going out of town in three days) the only other option is that I do it in person at the Post Office. I suppose there has been a problem with evildoers who have someone else’s mail held for shits and giggles while they twirl their mustache, otherwise they wouldn’t require all this crap, right? Off I go to the Post Office. The nice lady at the counter gives me a short form, which I fill out while we chat pleasantly about the weather and my upcoming fishing trip. I hand her back the form and go on my way. No ID or any “verification” was requested, much less required. Aaargh! [Previous page](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368.md?page=1) [Next page](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368.md?page=3)