Trade your password for a bar of chocolate? You would probably (and responsibly) decline, but some Londoners took up the offer.
Out of a small sample of 172 office workers that were approached on the street, more than a third (37%) willingly divulged their password when simply asked, according to Infosecurity Europe 2004's organizers. Sadly, a large majority -- a full 71 percent -- forked over the information when bribed with chocolate.
Last year, 90 percent of office workers approached at the Waterloo Station accepted a cheap pen in exchange for their password. 65% of those surveyed did so the year before in 2002.
Indeed while chocolate may prove difficult for those with a sweet tooth, many still fall victim to social engineering, or in this case, a little light prodding minus the candy. Interviewers found that by fishing for the answer, such as implying that it is likely to be someone they know or a favorite sports team, workers broke down and let the secret slip. 34 percent fell for this ploy. The most common passwords, incidentally, were based on the names of loved ones, cars, teams and pets.
The survey also found that 40 percent knew their co-workers passwords, and that 20 percent never change their passwords while 51 do so on a monthly basis.
Disturbingly, many keep their passwords in drawer scribbled on a piece of paper or in easily accessible Word files. Also troubling for its potential to launch both identity theft scams and breaches in corporate network security is the fact that roughly two thirds of those surveyed used the same password for work and personal business.
Luckily, 53 percent said they would never reveal a password over the phone, as opposed to walking up to them in the street and just asking apparently. What would the other 47 percent do? That's something for IT managers to ponder.
