Generic Passwords Expose Student Data

Makarand writes "The personal information of thousands of California children and their teachers was open to public view when the school districts issued a generic password to teachers using the system. Until the teacher used the system and changed the generic password to a unique password, anyone was able to type in a teacher's user name and generic password to gain access. Administrators shut down access to the service after a reporter phoned in to let them know that she had been able to access student information for all the children in two middle-school classes where the teachers had not yet changed their passwords." From the article: "'I'm fuming mad,' said Sarah Gadye, the San Francisco middle school teacher who discovered the problem Thursday -- three years after the district purchased the service for elementary and middle school teachers. 'My own child could go into this, figure it out and get all this data on all these students. It's mind-boggling.'"

Sigh

[GoodOmens]

I missed out on having the ability to hack my middle teachers computer's. All we had were apple IIe's and Oregon Trail (Which still rocks btw) :-(.

My college did a similar thing

[Idimmu Xul]

Only all the teachers passwords were blank, and they had superuser privaledges. I got in so much trouble for pointing that out :/

Re:1234

[Gr33nNight]

Thats the same combination on my luggage!!

Re:Don't Do It! Think Of The Fscking Children!

[baryon351]

> Don't you believe for one MINUTE that we won't prosecute either.
> Hell, we could just bypass the criminal justice system and sue
> your precious little girl.

could never happen! [danaquarium.com]

Integrity

[Saeed al-Sahaf]

WHat you should be teaching your child is that when they get cought, they should simply tell whoever that they are doing "security testing". According to what I read at Slashdot, that makes it "OK".

Re:That headline ticks me off

[roman_mir]

Pffft! You and your facts - how passe.

Re:Not new to me... teachers discovered!

[meringuoid]

The irony is, we found out about a log file that logs every visited web page, +username. One of the unpopular teachers even revisited pages students had visited minutes ago just to look at what they were looking at, effectively spying on "our" privacy.

You don't like them spying on you? Fine: throw some sand in their eyes.

Doctor that file! Replace every occurrence of BoringEducationalSite.com with KinkyBondageSlutz.net and watch the fun begin!

In other news...

[artemis67]

The city of San Francisco is looking for a new IT Manager. Must be able to come up with more than one password. Passwords with numbers a plus. Job to be filled immediately.

My company is just the opposite

[Quiet_Desperation]

My company requires new users to navigate the Labyrinth Of Despair, swing on burning ropes across the Chasms Of Molten Hate, do battle with a dozen skeleton warriors and all the while collecting obscure Myst-like clues in order to figure out the initial login password.

And if you forget your password, you have to do it again.

Blindfolded.

A new college hire involved in a password change request. [photobucket.com]

Some have suggested our IT folks have gone a bit too far. They claim not, but it's hard to argue with new account setup metrics of 14 dead, 39 severely wounded and 21 missing (presumed logged in).

Old teachers...

[vertinox]

From the article: "'I'm fuming mad,' said Sarah Gadye, the San Francisco middle school teacher who discovered the problem Thursday -- three years after the district purchased the service for elementary and middle school teachers. 'My own child could go into this, figure it out and get all this data on all these students. It's mind-boggling.'"

Just because you couldn't figure it out and your child could doens't mean you have to get pissy about it.

CPE-1704-TKS

[RoverDaddy]

was the launch code WOPR was searching for to fire off the nukes. Do I win the geek-of-the-year award now?

Re:My university did similar.

[Anonymous Coward]

...the modem pool, and the uni did nothing about it for the five years I was involved with them, from 1991 to 1995

Must have been a great university. Especially if they managed to squeeze 5 years into 4!

Re:1234

[qray]

I was using that for the parental controls on my TiVo, till my six year old son figured it out.
Fortunately he wasn't smart enough to keep quiet about it
--
Q