DEV Community

Discussion on: What are the worst security practices you've ever witnessed?

Collapse
 
prahladyeri profile image
Prahlad Yeri • Edited

In one of my last companies, developers used to set passwords such as "admin", "hello", etc. for their login.

Then the security team set strict policies, so everyone was forced to change their password and the new one should include numbers and special chars. So the devs changed it to "admin@123", "john@123", "jane@123", etc.

After some time, the security team realized that this too was futile, so they forced a password change every month. Now, the devs switched to "jan@123", "feb@123", "mar@123" and so on.

Not to mention, it was a very common practice among devs to share their passwords among each other, sometimes for work related stuff and other times for faking to the telemetry system which calculated hours worked.