|
I post this question to you: If I post the most commonly used passwords in the user database of a large website, can you do anything with that? You don't have the usernames or emails. You don't have any unique passwords, just the 5 most common ones, which hundreds or thousands of people use. Something like:
Ok, now you probably know the 5 most common passwords for AOL, MSN, Wikipedia, Fark, Digg, MetaFilter and most likely Slashdot. What are you going to do with those? By posting this here, have I lessened the security of any of those services?
The answer is a resounding NO.
Yet yesterday I posted just such passwords on a public forum, during a discussion on bad passwords and password security. Users, not being at all familiar with security FREAKED THE HELL OUT. I was called incompetent, foolish, amoral, unethical and more. One of the people even emailed my boss to complain about this 'breach of trust'. When it came down to proving to them that there was no security flaw created, then claimed it was unethical. When it was clear there was no ethics problem, they called it a violation of the account owners' Terms of Service. When it was clear that was not the case they claimed I broke standard 'business rules'.
I even had one foolish individual claim that their 'perceived threat' was a 'real threat'; that the bogeyman in the closet was real because the kid hiding under the covers was frightened of shadows.
I have to shake my head at the illogic here, but I learned something. When it comes to users, their lack of knowledge can be more important than the knowledge they have and share, as far as keeping the peace on the forum they are participating in. It was also drilled into my head, once again, that I should never underestimate the stupidity of groups, even when taken on an individual basis the members of that group can be quite intelligent.
And so, you learn from my example: assume a lack of logic, not an abundance of it.
