RSA asks for plaintext Twitter passwords on conference reg page • The Register Forums

Friday 22nd January 2016 04:18 GMT Randy Hudson

Single sign-on?

"into a page that is obviously not using single sign-on"

You keep using that word. I do not think it means what you think it means.

7 0 Reply
1. Friday 22nd January 2016 11:34 GMT dotdavid
  
  Re: Single sign-on?
  
  Inconceivable!
  
  1 0 Reply
2. Friday 22nd January 2016 11:43 GMT allthecoolshortnamesweretaken
  
  Re: Single sign-on?
  
  I understand Tinder (and the likes of it) uses single sign-on, so what's wrong with that?
  
  0 0 Reply
Friday 22nd January 2016 05:13 GMT Someone Else

SoshelMeeja...

...will reduce the world to a mindless swarm of blithering eejits! Just goes to show you how really brain-dead stoopud Twatter minions really are. (And these particular morons are supposed to be the security weenies for the Great Corporate Machines that want to rule the world! The ... mind ... just ... boggles....)

^{El Reg needs a moron icon}

2 2 Reply
1. Friday 22nd January 2016 12:58 GMT phuzz
  
  Re: SoshelMeeja...
  
  The world is already a swarm of blithering idiots, social media just allows you to see them more easily.
  
  5 0 Reply
Friday 22nd January 2016 05:19 GMT streaky

You got your password in my Oauth

You sure this isn't a signup for Black Hat or the CCCC or something? :p

No really though do people still trust RSA with literally anything?

0 0 Reply
1. Friday 22nd January 2016 05:40 GMT Christian Berger
  
  Re: You got your password in my Oauth
  
  Well the CCC actually proudly proclaims "We are not on Facebook".
  
  1 0 Reply
Friday 22nd January 2016 05:28 GMT Winkypop

They know their audience well

Most of them anyway.

2 0 Reply
Friday 22nd January 2016 05:43 GMT Christian Berger

Well it's RSA

They sell closed source "security" solution... that alone would be a reason to not trust them as finding back doors is incredibly hard there... plus they have a track record of actually working with the NSA to put in back doors.

4 0 Reply
1. Monday 25th January 2016 02:59 GMT NickHolland
  
  Re: Well it's RSA
  
  ... and don't forget their 2011 security breach pretty much negated the second-factor part of their "Two Factor Authentication" solutions.
  
  0 0 Reply
Friday 22nd January 2016 06:51 GMT Anonymous Coward

"...making fun of those sheep willing to use their passwords in RSA's registration form"

I don't know about sheep, but I would say that anyone who went along with this should resign as a security professional : they clearly don't have a clue about even the fundamentals of security.

14 0 Reply
1. Friday 22nd January 2016 11:46 GMT allthecoolshortnamesweretaken
  
  Re: "...making fun of those sheep willing to use their passwords in RSA's registration form"
  
  It's actually a clever test *wink*
  
  0 0 Reply
Friday 22nd January 2016 06:55 GMT G2

interesting list there

looking on Twitter at the list of so-called 'security professionals' and security decision-makers that handed over the passwords to their Twitter accounts makes me cringe and despair... wtf were they thinking?

some highlights of what i have found:

----------------------------------

https://twitter.com/MichaelMrak/status/645966789386465280

@MichaelMrak

Data Protection, Anti-Corruption and Anti-Money Laundering Expert.

----------------------------------

https://twitter.com/rshullic/status/653999276779925504

@rshullic

Cyber security professional specializing in cybef security, cyber risk, and security architecture. CPP CISSP, ISSAP, ISSMP, SSCP, CCFP-US CISA CIPP, CIPM, CRISC

----------------------------------

https://twitter.com/Todd_Inskeep/status/655812425158029312

@Todd_Inskeep

Todd explores InfoSec, risk management and identity in new business models & emerging tech - e/m-commerce, payments, and social media - personal opinions

----------------------------------

https://twitter.com/RubyZefo/status/656685690567024640

@RubyZefo

Intel Corp. Vice President Law & Policy Group, Chief Privacy & Security Counsel.

----------------------------------

https://twitter.com/TrustedComputin/status/661571533362601984

@TrustedComputin

Trusted Computing Group develops open standards for computing security.

----------------------------------

https://twitter.com/MarkVillinski/status/664275890797441028

@MarkVillinski

Security Industry Marketing Professional for Kaspersky Lab.

----------------------------------

https://twitter.com/lonatherrien/status/666312007696703488

@lonatherrien

PR & Marketing @RSAsecurity

----------------------------------

https://twitter.com/archangelnikk/status/666343331857854468

@archangelnikk

Information Security and Risk Executive #CISO #InfoSec #CSO #cybersecurity #egyptology thecsoblog.com

----------------------------------

https://twitter.com/Stephani_Lewis/status/674287335673040896

@Stephani_Lewis

Social Media with Intel Security. Helping businesses balance the innovation and evolution of technology with security.

----------------------------------

https://twitter.com/klstickels/status/681962465740124161

@klstickels

Americas Field & Channel Marketing Manager for RSA, The Security Division of EMC. Follow me to learn more about EMC & RSA marketing activities.

----------------------------------

https://twitter.com/Kojiro200/status/682108370438995968

@Kojiro200

Trade commissioner at the Embassy of Canada in Tokyo to assist Canadian ICT companies to develop business in Japan.

----------------------------------

https://twitter.com/CyberRiskLady/status/684107363914256385

@CyberRiskLady

Security Professional - Balancing Cyber Risk Management, Business and Strategy. @KatzcyLLC President & VirginiaTech MBA Advisory Board President

----------------------------------

https://twitter.com/BrickDuck/status/686932327465914368

@BrickDuck

Prncipal, Brick Duck Communications. Helping smart organizations float, fly, defy. Media designer and commentator, writer, former CNN executive producer.

----------------------------------

https://twitter.com/jasoncliu/status/687436723358416896

@jasoncliu

Product Marketing Manager at Cisco, MBA from Tepper, USC Trojan. Car | Sports | Technology Enthusiast.

(Note: hmm.. Product Marketing Manager at Cisco and they still gave up their password for a tweet after the NSA scandal?? now we have a lead on how NSA got their fingers in... they just asked one of the Cisco guys to hand over their passwords.. they probably paid them with a bar of chocolate..)

----------------------------------

https://twitter.com/tynanwrites/status/689965980043382785

Dan Tynan (Verified account)

@tynanwrites

Editor-in-Chief, Yahoo Tech. Opinions expressed here belong entirely to me; my pants are another story. RTs = Real Tasty

(woops... Yahoo bigshot there... gave up their Twitter account password. lol)

----------------------------------

/END MAJOR FACEPALM.. and the list goes on..and on... i just highlighted a few.

17 0 Reply
1. Friday 22nd January 2016 08:07 GMT agatum
  
  Re: interesting list there
  
  so-called 'security professionals'
  
  The age of linkedin et al offers too easy way to become a self-proclaimed pro. Too easy to add a 'skill' of something even though you have just touched the said something with a bargepole.
  
  1 0 Reply
2. Friday 22nd January 2016 08:32 GMT Robert Helpmann??
  
  Re: interesting list there
  
  Works for me. Now that they have identified themselves, we can send the lot on a junket aboard the 'B' Ark and all will be well.
  
  4 0 Reply
Friday 22nd January 2016 08:51 GMT Anonymous Coward

They can all go with the Golgafinchans....

after outing themselves as real consultants that dont know more than you tell them...

0 0 Reply
1. Friday 22nd January 2016 11:48 GMT allthecoolshortnamesweretaken
  
  Re: They can all go with the Golgafinchans....
  
  "Consultards" - there, FTFY.
  
  0 0 Reply
Friday 22nd January 2016 08:58 GMT Anonymous Coward

Hopefully

Maybe they're just building themselves a blacklist - people who will not be allowed to attend any future security conference etc.

I also expect that 90+% of the credentials they've stored are completely bogus.

But then again, I might be being too generous here.

1 0 Reply
Friday 22nd January 2016 10:19 GMT Anonymous Coward

"There is no suggestion that RSA, one of the biggest security companies in the world, would do anything malicious with the credentials; rather, it represents a blatant failure to observe best practice."

My immediate reaction was that this was intentional - an ironic demonstration of how bad end users are at protecting their passwords.

I expect one of the conference papers will be along the lines of "xx% of IT professionals will enter their password into a web page just because you ask them to" - a variation on asking people for their password in exchange for a bar of chocolate.

http://news.bbc.co.uk/1/hi/technology/3639679.stm

It does make good business sense, when you remember that RSA are a big vendor of non-password authentication systems.

9 0 Reply
Friday 22nd January 2016 10:52 GMT jake

The keyword in the article is ...

... "Executive".

These are management bods with MBAs and absolutely zero clue about actual technology, much less security. My hope is that RSA did it on purpose to name names & ridicule the idiots. Needless to say, I'm not holding my breath.

When I run across this kind of thing (was common a couple decades ago, fairly rare these days), I use "YouGottaBeKidding!" as the handle, and "FuckOff,Assholes!" as the password.

4 0 Reply
1. Friday 22nd January 2016 15:34 GMT Adam T
  
  Re: The keyword in the article is ...
  
  Looking through the Twitter feed, it did strike me that most of those who fell for it are marketing and recruitment. There's some relief that the 'real' security people may have (largely) shown more sense, and can laugh at those people who get paid more, but are now shown to actually know sod all.
  
  Karma?
  
  1 0 Reply
2. Sunday 24th January 2016 00:51 GMT channel extended
  
  Re: The keyword in the article is ...
  
  And when I give my email it's 'God@aol.com' solves many prob's.
  
  0 0 Reply
  1. Monday 25th January 2016 10:15 GMT jake
    
    @channel extended (was:Re: The keyword in the article is ...)
    
    Why lie. I truthfully use "root@127.0.0.1".
    
    You'd be surprised how many ill-configured systems accept it.
    
    Doesn't impact anybody else's system, either ;-)
    
    1 0 Reply
Friday 22nd January 2016 11:23 GMT Doctor Syntax

"it represents a blatant failure to observe best practice"...for even the most lax definition of "best practice".

0 0 Reply
Friday 22nd January 2016 11:53 GMT allthecoolshortnamesweretaken

Funny story for the weekend, almost a fix for not having something by Dabbsy or Simon. Have a nice weekend, everyone! Cheers!

1 0 Reply
Friday 22nd January 2016 12:23 GMT Paul Smith

Apptitude test

Just think of it as a reverse aptitude test where anybody who signs up will be automatically considered for all infosec job opportunities. Considered and rejected.

1 0 Reply
Friday 22nd January 2016 15:29 GMT CPU

Doah!

Either idiots are attending the Conf, or RSA is trying to prove a point about how easy it is to get passwords through simple social engineering techniques (from idiots that go to Conferences).

2 0 Reply
Friday 22nd January 2016 15:46 GMT IT Hack

Affirmation

Well...as I've often said. Too many cowboys in our profession.

I for one am glad RSA did this. I hope to see heads rolling soon. I don't expect it though.

Fuckwits.

0 0 Reply
Friday 22nd January 2016 18:56 GMT Anonymous Coward

trust me

I'm a trained security professional

1 0 Reply
Saturday 23rd January 2016 11:21 GMT Tubz

It's RSA, would using any form of encryption matter to them using past history ?

0 0 Reply
Monday 25th January 2016 15:57 GMT Michael Wojcik

Enter their what so they can what now?

The registration process for the February 29 event asks delegates to enter their Twitter credentials so that a prefab tweet about their attendance can be sent.

Even if this did use OAuth, or indeed any other mechanism, why would anyone agree to this? "Sure, RSA, I'll let you use my name to advertise your conference!"

Idiots - or at any rate gullible (or narcissistic) fools - indeed.

Of course, as a dedicated curmudgeon, I've never tweeted anything. (I have a couple of Twitter accounts - a personal one and a work one - but only because I was asked to create them in order to follow other accounts. Which, to be honest, I never paid attention to; I stopped even retrieving the things years ago when Twitter made OAuth mandatory and broke Thunderbird integration.) But even if I did, I'd be damned before I let some organization forge messages from me.

1 0 Reply