WingNews logo WingNews GitHub [2]
top | item 4813889

Prince William photos accidentally reveal RAF password

63 points| Garbage | 13 years ago |nakedsecurity.sophos.com | reply

46 comments

order
[+] gushie|13 years ago|reply
".. if you are being photographed or filmed at your place of work, it may be sensible to remove any passwords which could appear in the background.. "

I've got some better advice. Don't stick passwords to the wall (or monitor) in the first place!

[+] scott_s|13 years ago|reply
I see no problem with it. Securing a room is a known problem, and relatively easy to do, particularly in a military base. You have physical locks and guards. If you know that the people who have access to the room should also be able to access that part of the network, the physical security secures the network.

The username and password, then, keep out people who don't have access to that room.

[+] stephengillie|13 years ago|reply
Even with the actual document photochopped out, the credentials could still show in a mirror or monitor. Or maybe soon we'll be able to recreate missing parts of images by analyzing the ambient light distributions in the rest of the photo...
[+] _b8r0|13 years ago|reply
Whomever put that up will be breached, which is not a pleasant experience. The level of dressing down will be aligned with the sensitivity of the environment the account is used for. In the case of MilFLIP, it's an Internet facing resource so there's nothing too serious.

Milflip's an Internet-based web site for military flight information, primarily approach processes for different places. If it's the same milflip it won't be too serious. The user guide is publicly available online[1], as is the site.

[1] - https://www.aidu.mod.uk/Milflip/help.pdf

[+] haberman|13 years ago|reply
Is "breached" a British word for "fired?"
[+] jread|13 years ago|reply
As an aviator in the US military, I'm not surprised. This is common practice. The system in question is for public domain UK aviation charts and pubs. Many of the unclassified systems I use have the user and password taped to the monitor.
[+] astrodust|13 years ago|reply
Why don't they either use a password manager, of which there are hundreds, or simply bolt on a "LOGIN" button on the keyboard?

You'd think, at least, that it could be in a binder hanging on the wall.

[+] mseebach2|13 years ago|reply
There is a certain chance that this is not, in fact, an example of bad password management. This service ("MilFlip") could be an internal service on an internal, secure network (the kind of networks that, if someone was to penetrate it, you have bigger fish to fry than keeping them out of "MilFlip") that just doesn't have a good way of turning passwords off - and, to be "secure", requires a non-simple password.
[+] gavinjoyce|13 years ago|reply
Probably another victim of ill-thought-out complex password requirements. If it's too complex to remember, it will probably end up on a post-it note.
[+] meaty|13 years ago|reply
Having worked for the MoD in the past, shit like this gets punished big time. They have quite stringent rules for managing credentials.

Whoever printed that out will probably be fired pretty much straight away.

[+] Tomdarkness|13 years ago|reply
It says in the article that the password was obvious and easy to guess so I doubt this is the reason.
[+] purephase|13 years ago|reply
Why don't they provide two-factor auth fobs in the military? It seems like the easiest solution to me. It's not like the technology is new.
[+] cs02rm0|13 years ago|reply
They do, for systems which require greater security.
[+] PaulHoule|13 years ago|reply
I've made mistakes like this before so I tend to go over office pictures with a photo editor before I post them.
[+] jnazario|13 years ago|reply
why is no one else commenting that it's 2012 and we still rely on passwords?
[+] manmal|13 years ago|reply
We have used passwords for thousands of years, so what are you getting at?
[+] rymith|13 years ago|reply
What else would you use? Biometrics are expensive, and far less secure than passwords in most instances. Besides, once you have that information, it will get converted to a hash (same as a password) so you're really stuck with the same problem from a hacking point of view. And once somebody figures out the rainbow table for your retina, what are you supposed to do, change your retina?

Two factor auth is really the best way, and although it's kludgy, it provides the best protection. And it includes a password.