Prince William photos accidentally reveal RAF password

http://nakedsecurity.sophos.com/2012/11/21/prince-william-photos-password/

by Garbage • 14 years ago

63 46 14 years ago

nakedsecurity.sophos.com

gushie• 14 years ago

".. if you are being photographed or filmed at your place of work, it may be sensible to remove any passwords which could appear in the background.. "

I've got some better advice. Don't stick passwords to the wall (or monitor) in the first place!

stephengillie2• 14 years ago

Even with the actual document photochopped out, the credentials could still show in a mirror or monitor. Or maybe soon we'll be able to recreate missing parts of images by analyzing the ambient light distributions in the rest of the photo...

mertd2• 14 years ago

Second option is rather unlikely, given how many unknowns you would be solving against (geometry of the seen, geometry of the not seen, incident light sources, camera response curve etc) from comparatively very little data (a continuous signal that is sampled and heavily quantized to just 8 bits per channel).

lshepstone• 14 years ago

It's actually a very clever way to seed access to their honeypot.

scott_s• 14 years ago

I see no problem with it. Securing a room is a known problem, and relatively easy to do, particularly in a military base. You have physical locks and guards. If you know that the people who have access to the room should also be able to access that part of the network, the physical security secures the network.

The username and password, then, keep out people who don't have access to that room.

lostnet• 14 years ago

Well yes, securing the world is a known problem. Look at the other wall.

gavinjoyce• 14 years ago

Probably another victim of ill-thought-out complex password requirements. If it's too complex to remember, it will probably end up on a post-it note.

kuring• 14 years ago

Reminds me of http://xkcd.com/936/

Tomdarkness• 14 years ago

It says in the article that the password was obvious and easy to guess so I doubt this is the reason.

manaskarekar• 14 years ago

What if your netadmin makes you change it every three weeks?

Edit: Whoever downvoted me obviously undermines how quickly 'password lag' builds up if you're made to change your passwords often and forced to not use the last 3 or 5 passwords again.

meaty2• 14 years ago

Having worked for the MoD in the past, shit like this gets punished big time. They have quite stringent rules for managing credentials.

Whoever printed that out will probably be fired pretty much straight away.

hellweaver666• 14 years ago

Unless it was Prince William of course...

antihero• 14 years ago

Fantastic OpSec, there.

mseebach2• 14 years ago

There is a certain chance that this is not, in fact, an example of bad password management. This service ("MilFlip") could be an internal service on an internal, secure network (the kind of networks that, if someone was to penetrate it, you have bigger fish to fry than keeping them out of "MilFlip") that just doesn't have a good way of turning passwords off - and, to be "secure", requires a non-simple password.

andrewcooke• 14 years ago

the manual for the service in question is here - http://www.google.cl/url?sa=t&rct=j&q=milflip&so... (from a google search of "milflip"). it seems to be a web site of charts (not terribly secret).

jnazario4• 14 years ago

why is no one else commenting that it's 2012 and we still rely on passwords?

rymith3• 14 years ago

What else would you use? Biometrics are expensive, and far less secure than passwords in most instances. Besides, once you have that information, it will get converted to a hash (same as a password) so you're really stuck with the same problem from a hacking point of view. And once somebody figures out the rainbow table for your retina, what are you supposed to do, change your retina?

Two factor auth is really the best way, and although it's kludgy, it provides the best protection. And it includes a password.

jnazario4• 14 years ago

you do realize this is the ministry of defense, right? they have budget and need. a clear cut case for better security needs than almost anyone. and they also have a history of saying "damn the usability" in the pursuit of their security goals.

some open source projects have better security, it seems, than the MOD. wtf? talk about an asymmetric world.

TillE• 14 years ago

> although it's kludgy

Some implementations are, but the concept is sound and can work smoothly. Your second factor could be a smart card or a USB dongle that's simply plugged in. Like an ATM, especially European ones.

manmal• 14 years ago

We have used passwords for thousands of years, so what are you getting at?

PaulHoule• 14 years ago

I've made mistakes like this before so I tend to go over office pictures with a photo editor before I post them.

_b8r02• 14 years ago

Whomever put that up will be breached, which is not a pleasant experience. The level of dressing down will be aligned with the sensitivity of the environment the account is used for. In the case of MilFLIP, it's an Internet facing resource so there's nothing too serious.

Milflip's an Internet-based web site for military flight information, primarily approach processes for different places. If it's the same milflip it won't be too serious. The user guide is publicly available online[1], as is the site.

[1] https://www.aidu.mod.uk/Milflip/help.pdf

haberman• 14 years ago

Is "breached" a British word for "fired?"

untog• 14 years ago

It is (AFAIK) more of a military-specific term, and means being disciplined rather than fired. I believe it stems from a "breach of discipline".

_b8r02• 14 years ago

No, it's basically a dressing down and formal disciplinary process.

jread2• 14 years ago

As an aviator in the US military, I'm not surprised. This is common practice. The system in question is for public domain UK aviation charts and pubs. Many of the unclassified systems I use have the user and password taped to the monitor.

astrodust• 14 years ago

Why don't they either use a password manager, of which there are hundreds, or simply bolt on a "LOGIN" button on the keyboard?

You'd think, at least, that it could be in a binder hanging on the wall.

jread2• 14 years ago

US military unclassified systems are a mess... a spaghetti bowl of disjoint networks, operating systems, hardware, desktop and Internet applications designed by a multitude of lowest bid government contractors with little sense for usability and often very poor technical skills.

purephase• 14 years ago

Why don't they provide two-factor auth fobs in the military? It seems like the easiest solution to me. It's not like the technology is new.

cs02rm0• 14 years ago

They do, for systems which require greater security.

spyder• 14 years ago

There is a similar risk for "real" keys: http://www.guardian.co.uk/science/2008/nov/14/key-photograph...

Prince William photos accidentally reveal RAF password

Related Stories