UK 'Admin' and '12345' banned from being used as passwords in UK crackdown on cyber attacks - LMAO

Link | Archive

'Admin' and '12345' banned from being used as passwords in UK crackdown on cyber attacks​

From today, new laws in the UK aim to make it tougher for cyber attacks to succeed and increase consumer confidence in the security of the products they use and buy.​

Common and easily guessed passwords like "admin" or "12345" are being banned in the UK as part of world-first laws to protect against cyber attacks.

As well as default passwords, if a user suggests a common password they will be prompted to change it on creation of a new account.

It comes as a home filled with smart devices could be exposed to more than 12,000 hacking attacks from across the world in a single week, with 2,684 attempts to guess weak passwords on five devices, according to an investigation by Which?

Password managing website NordPass found the most commonly used passwords in the UK last year were 123456 and, believe it or not, password.

The new measures come into force in the UK on Monday, making it the first country in the world to introduce the laws.

They are part of the Product Security and Telecommunications Infrastructure (PSTI) regime - designed to improve the UK's resilience from cyber attacks and ensure malign interference does not impact the wider UK and global economy.

Under the law, manufacturers of all internet-connected devices - from mobile phones, smart doorbells and even high-tech fridges - will be required to implement minimum security standards.

They will also have to publish contact details so bugs and issues can be reported and resolved and tell consumers the minimum time they can expect to receive important security updates.

UK'S 10 MOST COMMONLY USED PASSWORDS IN 2023​

• 123456
• password
• qwerty
• liverpool
• 123456789
• arsenal
• 12345678
• 12345
• abc123
• chelsea

"As everyday life becomes increasingly dependent on connected devices, the threats generated by the internet multiply and become even greater," science and technology minister Viscount Camrose said.

"From today, consumers will have greater peace of mind that their smart devices are protected from cyber criminals... We are committed to making the UK the safest place in the world to be online and these new regulations mark a significant leap towards a more secure digital world."

According to recent figures, 99% of UK adults own at least one smart device and UK households own an average of nine connected devices.

 

[Day of the Cope]

How could they possibly know this?

Data breaches. Yeah, despite them asking for passwords that look like a Welsh dictionary ran headfirst into an algebra equation, none of these fucking retards can store information in salted hashes. This is also the reason a) you should never reuse the same password on multiple websites and b) why I have a massive bitch about having to make a new account for no real reason.

By the way, if any website says you can't reuse a password when you try and change it, you're fucked. There is no reason for them to know that if they were using any kind of salted hash for storage. It's either being stored in an unsalted hash or plaintext.

 

[Google.com]

And definitely use one of those, not some piece of shit service like LastPass. They were a great service, but they were bought by some other company that didn't even salt their stored hashes, and ALL of it got leaked.

I was too suspicious of password managers getting hacked to use one till I found out proton pass came free with my email. I'm very pro password manager now especially with the email alias system they have.

 

[Day of the Cope]

I was too suspicious of password managers getting hacked to use one till I found out proton pass came free with my email. I'm very pro password manager now especially with the email alias system they have.

There is literally no reason to use anything other than your broswer's built-in password manager. Most modern browser enable you to sync between devices and even from desktop to mobile.

 

[Google.com]

There is literally no reason to use anything other than your broswer's built-in password manager. Most modern browser enable you to sync between devices and even from desktop to mobile.

Disagree, browser one doesnt have the email alias functions in proton pass and proton pass on my phone I can use in other apps.

 

[Overly Serious]

bcrypt can be reversed it's just alot more resource-intensive and slower than trying to reverse a simpler algorithm with more issues like MD5,

Now I never said that bcrypt wasn't reversible. I was just pointing out the newer technology to someone who was talking about hashing.

I do think a lot of systems forbid offensive words and phrases.

This sounds absurd but is true. I ran into it myself once where a password kept getting rejected and I couldn't figure out what rule I was violating. I eventually realised that if I removed or broke up the word 'fuck' in the password, it would be allowed. Fuck me!

And then the password managers start getting hacked...

Hacked? Government mandated backdoor more like. Honestly if you want security for your own personal needs you're better off going with something like Kaspersky. It's very good but the reason is actually something else - if you do something "wrong" you have way more to fear from your own government's police than some country's half way round the world.

By the way, if any website says you can't reuse a password when you try and change it, you're fucked. There is no reason for them to know that if they were using any kind of salted hash for storage. It's either being stored in an unsalted hash or plaintext.

Unless I misunderstand you, that's not right. The point of storing the hash is that you can check if a password is the same, without actually knowing what it is. It's entirely plausible to keep a few recent hashes for checking against.

 

[A-Stump]

The best password is 'iamgay' so just in case your account is breached, you have the last laugh

 

[indigoisviolet]

Paul is on fire again.

 

[Flamin Park]

How are people still this stupid

You need to put numbers on it so it's Password123

Seriously though, you don't need your fridge, dialysis machine and cock ring to connect to the internet

 

[pikachudidnothingwrong]

What about 54321?

That remind me of that clip from Spaceballs.

LOL classic!

 

[Super-Chevy454]

What about 54321?




LOL classic!

Indeed and that's a classic who aged well.

 

[Tasty Tatty]

Just upgrade to Ars3n4lChAmpS! and it'll be safer.

I'm not joking.

 

[XYZpdq Jr.]

on the subject of sportsballings and passwords iirc there was a cute bit in the Ghostbusters comics (real gang not the modern groups) where they had to activate the Really Important And Bad Thing with the special passphrase, something that would never be spoken under any circumstances in the Ghostbusters headquarters in NYC, iirc it was something to the effect of
THE RED SOX ARE THE BEST BASEBALL TEAM EVER

 

[Day of the Cope]

Unless I misunderstand you, that's not right. The point of storing the hash is that you can check if a password is the same, without actually knowing what it is. It's entirely plausible to keep a few recent hashes for checking against.

Without a "salt", it's possible to figure out everyone passwords from a few individuals.

Likewise, reusing the same salt every time someone makes a password completely defeats the purpose of salting the hash.

 

[Tinnitus]

@12345 what's your password?

For your personel safety i need to aquire it

 

[12345]

@12345 what's your password?

For your personel safety i need to aquire it

But my luggage though? It's still safe, right?

 

[⠠⠠⠅⠑⠋⠋⠁⠇⠎ ⠠⠠⠊⠎ ⠠⠠⠁ ⠠⠠⠋⠁⠛]

what about 'n1gger'?

 

[my password is in bcrypt]

Without a "salt", it's possible to figure out everyone passwords from a few individuals.
View attachment 5952917
Likewise, reusing the same salt every time someone makes a password completely defeats the purpose of salting the hash.

https://www.explainxkcd.com/wiki/index.php/1286:_Encryptic ah yeah like what adobe did