Passwords.txt Link

If you need a password for an application, do not use a text file. Use .env files (and add .env to your .gitignore), or better, use a secrets manager:

Developers are the worst offenders. A junior developer hardcodes a database password into a Python script, tests it locally with passwords.txt, and then accidentally git pushes it to a public repository. Within 10 minutes, automated bots (GitHub scanners) have cloned the file. Within an hour, your AWS console is being logged into from a foreign IP address.

Probably not. As long as humans prefer visible, simple solutions over encrypted complexity, the text file will live on.

However, operating systems are fighting back:

But the ultimate solution is education. Run a workshop at your company. Search your shared drives for *.txt or *.xlsx that contain the word "password". You will likely find dozens.

A mid-sized law firm used a shared network drive (X:). Every paralegal had access. One paralegal kept passwords.txt on the desktop, which automatically synced to the firm’s lax OneDrive configuration. A phishing attack on that paralegal gave the attacker access to the file, which contained the managing partner's email password. The resulting business email compromise (BEC) cost the firm $700,000.

Even if a hacker doesn't steal the file, leaving passwords.txt on a server causes other problems:

Here's a simple example of securely storing passwords using hashing and salting with Python:

import hashlib
import os
import secrets
def hash_password(password):
    salt = secrets.token_bytes(16)
    hashed_password = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, 100000)
    # Store the salt and hashed password together
    return salt + hashed_password
def verify_password(stored_password, provided_password):
    salt = stored_password[:16]
    stored_password = stored_password[16:]
    new_hash = hashlib.pbkdf2_hmac('sha256', provided_password.encode('utf-8'), salt, 100000)
    return new_hash == stored_password
# Example usage
if __name__ == "__main__":
    password = "mysecretpassword"
    stored_password = hash_password(password)
# Verify
    print(verify_password(stored_password, password))  # Should print: True
    print(verify_password(stored_password, "wrongpassword"))  # Should print: False

This example uses PBKDF2 with HMAC and SHA256 for password hashing, combined with a randomly generated salt for each password. Always follow best practices and current standards for secure password storage in your applications.

If a user saved passwords.txt from an email attachment or downloaded it from a company portal, it lives in the "Downloads" folder. Attackers using Remote Access Trojans (RATs) often check %USERPROFILE%\Downloads\ first.

Sysadmins often create quick backups: passwords.txt.bak, passwords.txt.old, passwords.txt~ (a swap file). Web servers are configured to serve HTML files, but many are also misconfigured to serve .txt or .bak files as plain text. Visiting that URL dumps the keys to the kingdom.