Hacker News Reader

Comment by sirnonw | Hacker News Reader

Funny how there is a post-it with a password glued to the screen of the computer in the lede image, now in plain sight for thousands of readers.

View on HN

Looks like there's a year at the end; might be to facilitate suckurity requirements such as yearly password rotation.

Some places do 3 months! It's amazing

PasswordAugust2025!

I keep a list of every time I change one of my work passwords with the date it would have expired, and it seems to fluctuate between 2.5 and 3.5 months with little consistency. Some of us used to have it locked so we didn't need to keep changing it, but they reenabled it some time ago and we got confirmation it was for some sort of external security requirements.

That was best practice until maybe 10 years ago. Point the people in charge of that to the NIST standards.

I hear cyber insurance companies (ransomware cover etc) still require outdated standards.

People think cyber insurance requirements are hard rules, but they aren't. For the most part, you just need to show effort as it's completely impossible to be 100% compliant with all standards. For example, if you weren't rotating passwords but had proper MFA on your accounts, you're fine. Hell they even have conflicting standards sometimes. I've been through this multiple times when I worked at an MSP. For the most part, leadership just pushes to meet those standards to cya, which makes sense, but as long as you don't demonstrate gross negligence, they'll pay out.

You'd be surprised (or probably not) how much incredibly critical infrastructure has one ancient lynchpin PC doing some weird essential thing with a post-it note password like NameOfCompanyYear! where it's clear based on the year that the password hasn't been reset in a quarter century

I think this is Ccjaas2004. I'm not 100% sure on the letters, but the year is easy to see. Hopefully, they've changed their password sometime in the past 21 years.

That's true. Now it is most likely Ccjaas2025.

I think you're correct. They probably use it as the password "format" and haven't updated the post-it in order to trick anyone trying to steal the password! What could go wrong?

That's CCJ who married AAS in 2004. The password is still the same. But what's the username and what's the service?

Everybody logs-in with the same username into the only app. It's a kiosk computer without a surviving vendor to support it.

The image URL contains a parameter for size in pixel, and it's modifiable...

It's ok, comes back clean on https://haveibeenpwned.com/Passwords, probably a few more years of life left in it!

Ah thanks for that. I've been meaning to change my password for a while, looks like this is a strong choice then.

My guess: Ccjacs 2004

Odds are it hasn't been updated for 20+ years

Sorta how those Fox Raw livestreams on YouTube Live consistently show the inner workings of room-to-room shuffles and background whispers INSIDE the White House for the entire online world to dissect; it's definitely a security flaw but maybe not considered so by either Fox or the admin.

@Dang can you please delete this comment

OP might not be wrong, but let's at least follow SOP for disclosing security failures (30 days pre-disclosure)

We don't delete things unless the poster asks us to, and really I doubt this comment is creating any more risk than the picture itself on the WSJ.

Fair enough!

Reply on news.ycombinator.com