How many IT professionals does it take to screw in a light bulb?

If I had anything to do with an IT department now, the first questions at the monday morning meeting would be about security. Are all patches on, has every server been checked to see if one is missed, firewall up to date and so forth. Seeing the chaos of someone heisting a data file from just a game company, what is going to happen when a group penetrates the Federal Reserve or the core of a major bank. (You know. One that is Too Big To Fail.)

I have used an online trading company for years, and they have good security - at least on the customer end. My password there is massive and uses weird characters seldom seen outside of a programming script. And they tend to get paranoid if they see a different PC accessing the same account.

So, I needed to create an account at another one of the largest mutual and stock trading companies in the world. More to the point, they have a lot of my money. Everything went great until I fed it the new password that I had made up. One guaranteed to resist the cracking attempts of the new quantum computers that the hackers will soon have.

A problem. Error! No special characters are allowed! WTH? That is a security 101 item.

Ok, I'll brute force it by making a really long one.

Error! Sorry, passwords have to be twelve characters or less. That floored me. That is a security kindergarden no-no.

So, we have a company who does most of their business with customers via the Internet, holding a trillion dollars of customer's money (not all of that is mine) and requires their users create a password that would stand up against a single PC with a rainbow table for how long? 1 second? 5 seconds? 8 milliseconds?

An email to the company asking how long it had been since their chief security officer had gotten his GED has gone unanswered.

But my money is leaving them as fast as practicable.

There's a bank here (one of the largest as well) whose online password system requires that it be four letters and two numbers (at least at the time it did).

EDIT: Well, that seems to have changed. Their password page now suggests that you don't use 6 digit passwords (perhaps in an attempt to get people to move away from the old restrictions?).

For the first few years that Safari was out one major bank had PC users run IE . Mac users were asked to run either IS for Mac which was dead at that point. Their other suggestion was version of netscape 4.something if I remember correctly. Also useless at that point.

The quantum computers the hacker will soon have???

I don't think we'll see portable quantum computers anytime soon, you basically need a lab full of experts and all sorts of kit, so governments will be the first to realise them, and you can bet you cant just homebrew one up from available parts

Of course, once one can be created with enough working qubits brute force breaking of passwords will be child's play

louishen said:

The quantum computers the hacker will soon have???

I don't think we'll see portable quantum computers anytime soon, you basically need a lab full of experts and all sorts of kit, so governments will be the first to realise them, and you can bet you cant just homebrew one up from available parts

Of course, once one can be created with enough working qubits brute force breaking of passwords will be child's play

Click to expand...

Sorry. That part was just some heavy humor. I guess it was heavy on the serious and too light on the ha-ha part. None the less, a gang of serious crackers that gets ahold of a password file can find some pretty serious hardware to hammer on it with, even today.

IT and good judgement sometimes have a "oil and water" relationship. Regardless, any password is hackable, it's just a mater of time. You can significantly reduce the time with the application of more resources, which are secured easily enough with more money. If the right people want in, they'll get in. Complex passwords just narrow the group of people and organizations that can do as they please with the data you choose to allow others to steward at your behest.

The Illinois Department of Labor web site will ONLY run on Internet Exploder. Nothing else.

BTW, should we be talking about breaking in via passwords? I thought discussing things that violate US law is forbidden on mac-forums.com.

No one is talking about methods of doing so and as such, the discussion is fine.

Anyway the answer is 3.

One to check the specs and compatibility and order it up;

one to install the bulb and get it up and running and

one to turn it off and then turn it back on again

Which one of them documents the findings?

dauber said:

Which one of them documents the findings?

Click to expand...

They generally have PMP somewhere though.