Hacker News Reader

Comment by IceDane | Hacker News Reader

Why would you think active directory has anything to do with this? That seems like a super random conclusion.

What happened is they found the password and email for an employee in a dump online - possibly for a different service, we don't know. If so, then the password was reused.

View on HN

I mostly agree with you, but it's worth considering that there are much more fundamental issues with absolutely abysmal passwords like "123456" . If my password is "ra1nbowC0okies776", and it shows up in another place, it's a pretty strong signal that I reused it, because it's unlikely to have been picked independently by someone else. If my password is "password", even if I never reuse it, that's still far worse than me reusing the password above.

That is completely irrelevant to anything I said. No one on hacker news thinks that using 123456 as a password is a good idea.

You said the password was "reused". I think that's a poor framing and was pointing out.

You should read what I wrote again.

I said if the dump was for another service, it was reused. Otherwise the dump was literally for the service that gave them access to the CPR data. In either case it was found in a data dump - that has been confirmed.

From my perspective, I read what you said fine, and you didn't read what I said at all, which was that that I agree with you with the exception that "reuse" is an irrelevant thing to bring up in this situation.

Reply on news.ycombinator.com