30

I have downloaded a couple of Virtual Machine images from http://modern.ie, in order to test different versions of Internet Explorer.

When running these images, a complete Windows environment is started, with a default user account. The details for the user account are displayed in clear text on the Windows desktop background:

Screenshot of the Windows desktop

What is the reason for complicating the password (e.g. Passw0rd! instead of just password), when the password is clearly visible to anyone, and is supposed to be public?

  • 27
    I doubt there's a real thought-through reason for it. Smacks of cargo-cult to me: a password must have some funny characters and numbers. stevemcconnell.com/ieeesoftware/eic10.htm – Alfred Armstrong Aug 21 '15 at 8:34
  • 3
    So, in this particular case, it's probably because that's the Well Known demo password. – Steve Aug 21 '15 at 16:54
  • 1
    It also stops run-of-the-mill exploits from pwning your system by guessing the ubiquitous "password" password. – sleblanc Aug 24 '15 at 1:47
31

In addition to the password policy (upper case+lower case letters, number, non alphanumeric character, >8 digits), it also leads to clarity. Some users might be confused by the password being password, depending how it's displayed, especially if it's mixed with other information. Yet for all but the mentally challenged users it's immediately clear that Passw0rd! is a password, which reduces the amount of support queries.

  • 3
    «Some users might be confused by the password being password» - very good point. – Vidar S. Ramdal Aug 22 '15 at 19:59
  • 1
    Make the password "allonewordlowercasenospaces". – Schwern Aug 22 '15 at 20:04
  • Or even better "All One W0rd Lower Case No Spaces With Quotes". – Prateek Aug 24 '15 at 8:17
  • 1
    I am marking this answer as accepted, as I liked the it's immediately clear that Passw0rd! is a password point. As stated in other comments, password policies were not the issue. – Vidar S. Ramdal Aug 24 '15 at 8:47
  • 5
    This reminds me of my old school: the root account for the classroom server had the password "dasgleiche" ("the same" in German). You could literally tell another admin loudly "the password is the same" with 30 students listening and none of them would ever get it. – Jörg W Mittag Aug 24 '15 at 10:04
58

Reason may be:

This Windows has implemented a strong password policy, thus the user MUST HAVE a "strong" password.

  • 10
    "strong" haha ­­­­ – Mark K Cowan Aug 22 '15 at 12:13
  • 4
    Well, no. I had no problems changing the password to password, so policies can't be the reason. – Vidar S. Ramdal Aug 24 '15 at 7:16
  • @VidarS.Ramdal, perhaps other systems have stricter password policies that would not let you make such a change, yet they want to use the same password on all systems for simplicity. – Kat Aug 26 '15 at 15:19
  • It a seems all those VM images use the same password and policies. – Vidar S. Ramdal Aug 26 '15 at 17:52
29

Password policy.

You have to jump trough some hoops to get Windows to accept "password" (no capitals, no digits, no non-alphanumerics).

But it will accept "Passw0rd!" right out of the box.

  • 3
    I was able to change the password to password without any problems. – Vidar S. Ramdal Aug 24 '15 at 7:16
  • @VidarS.Ramdal: Thanks! I guess I was thinking about domain joined machines and thought that this applied to all standalone Windows machines as well. – StackzOfZtuff Sep 7 '15 at 7:25
15

Depending on how the virtual machine is configured, the password complexity may be a requirement that's enforced by the system's security settings.

  1. On the virtual machine, run secpol.msc.
  2. Navigate to: Security Settings\Account Policies\Password Policy
  3. Observe the value for "Password must meet complexity requirements"

By default, standalone systems have this disabled. Domain controllers, and other systems that are members of a domain, have it enabled by default. If the system is not a domain controller or domain member, it's possible that the developers manually applied a security template to the VM.

If you double-click that setting, and go to the "Explain" tab, you'll see exactly what this policy enforces. I've also listed the requirements below.


The password must...:

  • Not contain the user's account name.
  • Not contain more than two consecutive characters out of the user's full name.
  • Be at least six characters in length (unless another minimum length is specified).
  • Contain characters from 3 of the 4 character types:
    • Uppercase letters
    • Lowercase letters
    • Numbers
    • Non-alphanumeric characters

If the setting is disabled, then another possibility is that Passw0rd is just a one-size-fits-all, generic password that the developers are accustomed to using so that it will be accepted on any system they're testing. (Though, it should be noted that this would not be accepted on any systems using CIS/NIST security templates - those require a minimum of 12 characters.)

  • The setting is disabled, so password policies is not the reason. – Vidar S. Ramdal Aug 24 '15 at 7:44
  • Then the developers who built the system are really the only people who can answer for this. – Iszi Aug 25 '15 at 14:42
2

The only reason I can think of, is the case when the password is meant to be changed and they want to indicate to the users that they should use a complex password.

  • I disagree, there's no reason to change the password in a virtual machine dedicated to use the Edge browser. – A.L Aug 24 '15 at 12:14
  • I was reffering to the generic question in the topic, but I agree with you, that in this situation this is not the reason and way more accurate answers have been posted here. – bayo Aug 24 '15 at 12:37
2

The site you point to is a site for developer tools, and specifically VMs created for the sole purpose of testing different versions of IE.

Casually released developer tools like this normally are given far less scrutiny, and are less polished than a full release of a major product. There's really no good reason why Passw0rd! is any more secure than password, especially when it's public. It's likely that the developer who created the VM didn't give it more than 2 minutes worth of thought, and it was never scrutinized beyond that.

protected by Community Aug 22 '15 at 1:11

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.