在我以前工作的店里有个不错的。通往非公共区域的门有小键盘，所以你必须输入pin码才能进入。然而，你只需按#，门就会打开，这是我们喜欢的事实，因为按#比按6位pin码容易得多。

几年前，一所学校托管了一个学习平台网站，可以上传。php文件到网站上，然后再执行，所以他们给了你整个网站的完全访问权限。还没有被其他学生发现，我认为这个错误仍然存在。

About 3 years ago I built a site for a somewhat large non-profit organization in our state. When it came time to deploy the application to their web host server, I noticed an odd file named "cc.txt" or something obvious like that in their public site. It was under their web root, was getting served, and was a csv file of all their donor's names, addresses, credit card numbers, expiration dates, and CVV/CVC codes. I cannot count the number of times I brought the issue up - first to my boss, then our company accountant, the client's IT director, finally the client's President. That was 3 years ago. The file is still being served, it can even be googled. And it's been updated. I tend not to respond to their donation solicitations when I get them.

社会工程:

<Cthon98> hey, if you type in your pw, it will show as stars
<Cthon98> ********* see!
<AzureDiamond> hunter2
<AzureDiamond> doesnt look like stars to me
<Cthon98> <AzureDiamond> *******
<Cthon98> thats what I see
<AzureDiamond> oh, really?
<Cthon98> Absolutely
<AzureDiamond> you can go hunter2 my hunter2-ing hunter2
<AzureDiamond> haha, does that look funny to you?
<Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as *******
<AzureDiamond> thats neat, I didnt know IRC did that
<Cthon98> yep, no matter how many times you type hunter2, it will show to us as *******
<AzureDiamond> awesome!
<AzureDiamond> wait, how do you know my pw?
<Cthon98> er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
<AzureDiamond> oh, ok.

从bash.org

对我来说，情况并没有那么糟糕，因为数据并不是那么敏感:

我得到了一个Excel文件，里面满是要更新的宏，每个表都是锁定的，宏部分有密码保护。我拿到了密码，但我想我还是试着破解一下吧。

我找到了一个程序，可以在大约十分钟内完成，其中大部分时间可能只是下载时间。这个神奇的产品是什么，能如此快速和轻松地突破Excel安全?OpenOffice.Org。

我不确定Office 2007是否在这一点上有所改进，但让我感到害怕的是，许多非技术人员可能正在使用Excel来操作敏感信息，并认为它是安全的。然而，这些类型的人可能甚至不知道它提供的“安全”功能。

在一些Unix机器(当然是所有的SunOS)上，您可以将setuid shell脚本链接到一个名为“-i”的文件。 shell脚本将文件名解释为它的第一个参数，并运行"sh -i" =一个交互式shell，并获得setuid文件所有者的许可。

因为大多数setuid shell脚本都是以根用户身份运行的，以便允许您执行一些需要根用户权限的操作，比如弹出CD或加载磁带。这意味着在20世纪90年代，在大多数大学的Unix机器上获得管理是很简单的。