我所见过的最糟糕的是信用卡、个人识别码和姓名以纯文本形式存储。我差点心脏病发作了。

在一所不知名的大学，他们所有的动作查询都是通过URL传递的，而不是通过表单发布的。

这个东西一直在工作，直到谷歌Bot出现，运行了他们所有的url并删除了他们的数据库。

我曾经打电话给一个BBS，它在首页上有一个“Drop To DOS”选项。菜单上没有列出来，但我打错了，无意中找到了。

然后我可以远程访问这家伙的DOS命令行。

我见过很多客户项目，这些项目都包含IP地址、用户名和SQL server数据库的密码。

当我使用Colloquy (IRC)时，密码字段会弹出，但我仍然在主屏幕上集中，所以当我按下enter键时，全世界都知道我的密码，而我却没有意识到。

In the 1970's Stanford had IBM 2741 hardcopy terminals spread around campus networked to an IBM 360/67. Account passwords were three characters. During logon, the password prompt would overprint a three-position blob of about nine random uppercase characters, so the subsequently-typed password would supposedly be masked by the blob. However, everyone typed their passwords in lowercase, which were trivial to discern against the uppercase background blob. That meant you could usually walk up to any terminal, peruse the hardcopy typically left behind by the previous user, and easily logon with their account and password.