Ask Lemmy

The building, used by several hundred employees, had a security systems with 4-digit codes. I've been part of group of people who liked to work late times, and the building would lock at midnight -- the box by the door would start beeping and you would need to unlock it within a minute or so, or "proper alarm" would ensue.

However, to unlock the alarm you did not need your card -- all you needed to do was to enter any valid code. Guess what was the chance that, say, 1234 was someone's valid code? Yes.

We've been all using some poor guy's code 1234, and after several years, when he left the company we just guessed some other obvious code (4321) and kept using that.

By the way, after entering the code to the box by the door, it would shortly display name of the person whom the code "belonged" to. One of our colleagues took it as a personal secret project to slowly go through all 10000 possible codes and collect the names of the people, just for the kick of it.

(By the way, I don't work for that company anymore, and more importantly, the company does not use that building anymore, so don't get any ideas! 🙃 )

The last company I worked for has both NDA's and arbitration agreements, which would keep me from spilling company secrets and would screw me over if I did. But here is a secret - they use online PDF forms and don't check what text is entered into the signature.

They actually kept the domain admin password on a post-it under 2 different keyboards. One of which was secured from the public.

An European Country stores citizens' critical data in vulnerable databases, whose password is in HaveIBeenPwned, on a VPN whose certificates are stored in random NASs. The IT guys don't know how encryption and certificates work and I wouldn't be surprised if everything was in some adversary countries' hands

About 25 years ago I worked in a small town KFC franchise. Owner was, well, what you'd expect in a small town franchise owner - there was lots of pressure to cut costs and the manager had their job threatened at least once a month due to cost overruns (which cut into the owner's profits).

Manager quote, "I don't care if it's green, cook it anyway, nobody will tell once it's breaded and fried."

I worked for a government contractor that would have me log into to classified data to monitor uptime.

I was not cleared to view it nor did I have my own account so my manager had me log in with his credentials.

In the US where I'm located, that's a felony for the individuals and a massive fine for the company.

They let the intern access the production db. The company is one of the biggest hosting and internet service companies in the country. The db was SQL but had no primary key.

I was the intern. I normalized it to 3NF as part of my internship project.

Mike from Tom's Landscaping smokes a bowl of reefer in his car at lunch break every day.

Sorry Mike someone had to say something.