• Fizz@lemmy.nz
    link
    fedilink
    arrow-up
    45
    ·
    12 hours ago

    There is a business I walk past every day and when you look in the window you can see wifi login creds and her name and password. Ive considered saying something but then I’d have to explain why they shouldn’t do it and argue with them that its important.

    Plus they’re property managers so i would laugh if they got hacked.

    • squaresinger@lemmy.world
      link
      fedilink
      arrow-up
      30
      ·
      7 hours ago

      There was a common issue with a local ISP that their default wifi router passwords were based on the router’s MAC address.

      I scanned the wifis I could reach from my flat and found one that was vulnerable. Now I didn’t know who that wifi belonged to. I would have had to knock on everyone’s door, asking everyone if it’s their wifi. Couldn’t be bothered doing that and looking stupid doing so.

      So instead I logged into their wifi and from there into their router config web page (it also had the default credentials admin/admin) and changed the SSID to [old SSID]_hacked.

      The day after they had changed the SSID back and changed the password.

      • Trainguyrom@reddthat.com
        link
        fedilink
        English
        arrow-up
        3
        ·
        3 hours ago

        Realistically if the company fails due to their terrible cyber security practices there’s a high chance their properties will just be sold to an even larger property management firm

    • jaybone@lemmy.zip
      link
      fedilink
      English
      arrow-up
      11
      ·
      14 hours ago

      Not to mention that door is held together by two hamsters and a paper clip.

      • palordrolap@fedia.io
        link
        fedilink
        arrow-up
        1
        ·
        30 minutes ago

        What’s the alternative? It would have to be something that wouldn’t work if the user was unconscious and that offered plausible deniability if they were awake and being coerced.

        What, other than a password, offers that?

        Relatedly, I don’t even know most of my passwords these days. I use a password manager (one that doesn’t require internet access) that generated random strings. I only ever see them if I accidentally paste them into the wrong field.

      • Trainguyrom@reddthat.com
        link
        fedilink
        English
        arrow-up
        3
        ·
        3 hours ago

        The real problem is there’s not really a better solution that works well for private accounts owned by individuals who only have a single device.

        They say that authentication is using either something you know, something you have or something you are, but in the real world it ends up being something you’ve forgotten, something you’ve lost and something that you were at one time but are no longer