Anonymous posts usernames and passwords of US Congress staffers

http://sebsauvage.net/paste/?ffbc2662e12f6ca9#PmqIe7dqymVyxIConK1ODxgMH8Als2xW+QecE0PBvUg

by jessepollak • 13 years ago

96 70 13 years ago

thezilch2• 13 years ago

They've got nothing to hide, right? Is this FEMA? If our government can't be arsed to secure their authentication servers and passcodes (eg. salt+hash+fuckitandusebcrypt), how the hell can they be trusted with other's private data?

res0nat0r• 13 years ago

Congressmen on the hill are not the same people that the NSA is employing to do technical surveillance work and data collection analysis.

thezilch2• 13 years ago

Sure they are, the NSA precisely characterized Snowden as a high-school dropout. As well, I'm not convinced Congress staffers shouldn't be just a schooled as those data analysts. These are the folks first in line to help educate our Congress! They help or wholesale write bills! You're probably right though; no freaking wonder this circus has allowed the NSA and the like fly under their nose.

gmuslera2• 13 years ago

considering how much of those passwords are "password", i'd say that they don't feel like having anything to hide.

showerst5• 13 years ago

These look like they came from some sort of third party CRM, possibly http://www.iconstituent.com/ given the number of variations of iconstituent in the password list.

It says something about how thoroughly they vet their vendors, but it's not 'our government's security. (although requiring a full audit that deep before letting them pay a third party just makes them more lumbering and tech-phobic...)

jstalin• 13 years ago

Some of my favorite passwords from the list: notalentassclown3 password2 Password12 password5% password Password14 Password1 PASSWORD Password1@ password3# Password!1 Password45

etc...

seferphier• 13 years ago

this is my favorite

Eric.Slocum@mail.house.gov: Fuckface^1

rollo_tommasi• 13 years ago

I'd vote for whoever employs the guy whose password is 'Elimgarak06!'

codereflection2• 13 years ago

I like the all uppercase PASSWORD, like the intensity makes it more secure.

foobarbazqux4• 13 years ago

Yes, only a single capital letter is needed to make it more secure against automatic methods. But all-caps is probably more secure against an in-person attack, way more so than just 'password'.

pvnick2• 13 years ago

Wow. Bad move, Anon (and I'm the last person who would normally say that). This was a really crappy thing to do to innocent folks just trying to make an honest career, many of whom probably use the same credentials for their online banking and other important services. It gives a bad name to "hacktivists" (which are growing increasingly important in holding our government accountable) and will only take credibility away from the cause of transparency. Congress members will very likely take an "us vs them" mentality and lump Anon with "them" who want transparency wrt the NSA revelations.

Counter-productive and juvenile, that's all this was.

ddq• 13 years ago

Politics. Honest career. Pick one.

rbanffy• 13 years ago

If you are honest and don't want to enter politics, you cannot complain when less honest folks do so.

pvnick2• 13 years ago

My brother, a great guy, is starting his degree in civil engineering and is seriously considering one day working for the government to help develop systems that deliver water to people whom would otherwise not have enough water to survive. Should Anonymous hack his email account and dump his passwords on the internet?

antoko• 13 years ago

These aren't politicians they're staffers. Many people enter the political realm to affect policy change. Many of these people are driven by a desire to do good. You are painting with too broad a brush and your comment doesn't really add anything to the conversation.

Do some people enter politics because they just want power or they want to polish their ego? Sure! But that doesn't mean everyone in the industry is inherently a bad actor.

Even politicians (as opposed to staffers) sometimes take stands on moral issues - that would hurt them politically (rare but it happens)

foobarbazqux4• 13 years ago

Account created more than one hour ago. Troll. Pick one.

6d0debc0713• 13 years ago

Oh that is so untrue. Not everything to do with politics is the party political system. I've worked with planning officers and researchers who work in government before, and many of them are really nice people who are honestly trying to do their best for the people around them and the places they live.

Lots of people just spend their lives trying to research how to make the world a little less crap, or planning infrastructure, or trying to keep people in housing. With limited resources, and a system that backfires on them from time to time because they've relatively little power in the grand scheme of things (depending on government structure and incentives) but that doesn't make them bad people.

dragontamer3• 13 years ago

Anon has always been counter-productive and juvenile. To expect anything more than that is stretching it.

Anon is occasionally lucky with their targets (ie: they happen to line up to a good cause), but internet vigilantism consistently does crappy things to innocent people.

quantumpotato_• 13 years ago

What's sentiment like about Anon being false flag? HN please help remember, anon hacking sites where a (security incompetent) US official worked at..

pkinsky• 13 years ago

I don't consider Congress to be an honest career. Do you?

showerst5• 13 years ago

These aren't congress people, they're hill staffers. Huge difference.

gmuslera2• 13 years ago

In the other hand, that could give them a hint on what is being done by their employers to the rest the world, and that they are directly or indirectly helping to keep being done. Don't twist something into being bad only when is done to you.

signed0• 13 years ago

If Anon was able to get these passwords, I'd bet foreign spy agencies and black hats can as well. Plus with passwords as bad as these, it would have been trivial for someone to have guessed them in the first place.

Afforess• 13 years ago

Favorite password: cody.stewart@mail.house.gov: iConstituent

Obviously this leak is bad, but I think it's also humanizing. Staffers are people.

542458• 13 years ago

Curiously, more three people have the password Iconst!tu3nt, and one more that looks like a garbled version thereof. I wonder why five different people are using near-identical passwords - a default of some sort?

Iconst!tu3nt x3

iConstit*09

iConstituent

I feel bad for the people whose passwords were leaked, but I'm happy to see that there's (as far as I've seen so far) terribly embarrassing among the passwords. (Edit: okay, I was wrong on this one. notalentassclown3, Fuckface^1, poopypants1, DallasSucks10! and 1044shit, I'm looking at you)

Also funny: Senatebound2012!

superchink• 13 years ago

Looks like iConstituent is a CRM that they probably all use.

wtvanhest• 13 years ago

notalentassclown3

Its from office space right?

fnordfnordfnord2• 13 years ago

NOTE: FOR THE PURPOSES OF BEING FAR TOO GENEROUS WITH YOU GUYS, WE HAVE REMOVED SOME OF THE PASSWORDS AND SHUFFLED THE ORDER OF THE REMAINING ONES. THESE ARE ALL CURRENT, VALID CREDENTIALS BUT THEY ARE NOT IN THE ORIGINAL PAIRINGS. WE RESERVE THE RIGHT TO SPONTANEOUSLY DECIDE THIS RESTRAINT WAS UNJUSTIFIED.

Some are pretty easy to guess who they belong to. like TX32republican!

djKianoosh• 13 years ago

Some people use personally identifiable info in their passwords. Even though they shuffled passwords around so they don't match the username, if the user's name or address is in the password... yikes

antimora• 13 years ago

I am very surprised the policy of password strength is very weak. Allowing "smith" as a password? It's too weak that makes me suspicious about the origins of these passwords.

jaynos• 13 years ago

Most (probably all) of the Federal government requires password changes every month or so (not completely sure of the timeline) and you can't use previous passwords. This leads to shitty passwords just so people can remember something that always changes.

Aldo_MX• 13 years ago

Offtopic: One bank I use enforces 8 characters max and changes every 3 months, I ended up with /.+[0-9]{2}/ as the password since I would never trust my bank credentials to any means to save the password, and I would never write it in anything that it's not a password input (that includes a piece of paper).

If my bank get's hacked, don't be too harsh with my password, I swear I can't remember a new, unique, secure and constrained password every 3 months :(

showerst5• 13 years ago

These look like they came from some sort of third party CRM, possibly http://www.iconstituent.com/ given the number of variations of iconstituent in the password list.

I'd be willing to bet that the actual house/senate domains require strong passwords, I've interacted with their IT in a few situations and found them to be on the ball.

bound008• 13 years ago

Oh the classic and secure "Password1". Mixed case and even alphanumeric.

cloverich• 13 years ago

What is the point of doing this?

p37307• 13 years ago

Grief, the passwords are so lame. Do these people not realize how important strong passwords are. Corker06. lol. Senate09.

tjbiddle• 13 years ago

Searched for "password" - 36 results. The majority some iteration of 'password1', 'Password1', 'password2', etc.

Really wish government employees would be forced to use more secure passwords, or at the least heavily trained on the importance of them.

fnordfnordfnord2• 13 years ago

Assuming this is real. Most of these look like default passwords chosen by a clueless office administrator. They're all so similar.

XEKEP• 13 years ago

So what do we have? A bunch of weak passwords. Not bad they are revealed, actually, should educate some a bit. Still, revealing the passwords without the email addresses would've been a bit more responsible.

On the other hand, do they really store house.gov passwords unencrypted? I'm not even talking about salted vs unsalted hash here, just plaintext? Seriously?

showerst5• 13 years ago

These look like they came from some sort of third party CRM, possibly http://www.iconstituent.com/ given the number of variations of iconstituent in the password list.

codereflection2• 13 years ago

Some of these are really easy to match up. Using part of your name as your password is epically stupid.

jlgaddis• 13 years ago

I'm laughing now but I probably won't be later.

I'm afraid that the government will use this incident as "proof" that what they're doing thus far isn't "enough" and they need even more power and control... and, given the victims of this attack, I'm certain they'll get it.

kunai• 13 years ago

The first thing that came to my mind was: god, these are horrible passwords.

h0w412d• 13 years ago

Well, have you ever not thought that after a password leak?

lukifer2• 13 years ago

Makes me wonder if the responsible thing to do when running a web service is to constantly dictionary-attack and brute-force your own server, and whenever it gets a hit, email the user and force a password change. In theory, the userbase would evolve towards better passwords over time.

lukejduncan• 13 years ago

Can we get a warning in the title that this doesn't just link to an article?

peterwwillis• 13 years ago

Whatever happened to plain old defacing a website, like back in the day? This "dox" obsession isn't nearly as cool as proposing marriage to Madonna from a corporate website (though these days I guess it would be miley cyrus?)

TheCowboy• 13 years ago

I wonder how old this data is. I looked up one person I know who hasn't worked on the hill since 2010.

Anonymous posts usernames and passwords of US Congress staffers

Related Stories