McDonald's is not lovin' your bigmac, happymeal, and mcnuggets passwords

Change Your Password Day took place over the weekend, and in case you doubt the need to improve this most basic element of cybersecurity hygiene, even McDonald's – yes, the fast food chain – is urging people to get more creative when it comes to passwords.  McDonald's Netherlands operations took the opportunity on Sunday to …

[Chloe Cresswell]

I would never use bigmac as a password, or happymeal.

It would be like using realtek 8019 or 8139 as a password...

[Pickle Rick]

> realtek 8019

Yeah, a "real" tech would use the MD5 Hash!

=> a230e35259613fb10caa90b45d39e987

[Icon: I've really gotta get out more...]

[cd]

Why would any sentient being make an account at any big corp?

[Gene Cash]

Because they have good food and you go there all the time? (Obviously I'm not talking about McDonald's)

It's easier at one of the local restaurants to sit at a table and order online than stand at the counter and order. You sit down, scan the QR for your table, and their ordering website is really well done and easy to use. I've been waiting for them to screw it up, but they actually implemented two of my suggestions for improvement.

Also keeps me from punching the fucktards that stand 20ft from the counter then insist they're in line when I step up.

[MachDiamond]

"You sit down, scan the QR for your table, and their ordering website is really well done and easy to use."

I've dated a few nice ladies that were working as waitresses at local restaurants. You won't see a QR code for that.

[Claptrap314]

Well, you might. I mean, the ladies are *really* nice...

[Pickle Rick]

Read on! Word has it you need to speak to "Lynsee". Ask to "sample her cookies". Cash only!

[It's amazing how much I've learnt in these hallowed halls!]

[Gavsky]

Or, "Those QR codes! I mean, phwoar, eh?!"

[Pickle Rick]

QR Codes? Phwaor indeed!

It's not like the 90s, eh boys! Watching boring one dimensional EAN13 barcodes download line by line over ten minutes on a 36K US Robotics...

[Jou (Mxyzptlk)]

No GIF compression for the 1-bit color depth image? 'cause barcode is a prime candidate for it...

[RAMChYLD]

Also, spend enough time eating there and you have enough McRewards points for free coffee at McCafe for weeks.

Facepalm. Because I need coffee.

[Jou (Mxyzptlk)]

Humans <-> sentient is way too often mutually exclusive.

[Gavsky]

Ah, hence 'The AI Super Revolution'® Big Corps

Once it decides that we're irretrievably stupid, we're doomed!

[Aaiieeee]

Complex passwords are only relevant if the database or hashes get dumped

Therefore I am going to rely on megacorps infosec team to do their job and I will stick with 'nugget2nugget'. Its a risk I am willing to take!

[Blazde]

Re: Complex passwords are only relevant if the database or hashes get dumped

Before you trust your favourite web service to have sensible rate-limiting on login, stop and think about the last time you couldn't login because somebody else was already trying to

[I ain't Spartacus]

Re: Complex passwords are only relevant if the database or hashes get dumped

nugget2nugget is an online dating app for junior officers in the US Navy?

[ecofeco]

Insanity

Nobody, NOBODY should ever need a password to order a goddamn hamburger.

That everyone just accepts the absurdity of this situation is... insanity.

Now where are my Big Ass Fries?©®™

[Neil Barnes]

Re: Insanity

The vast majority of online activities have no need for a password. It's just that the people who run these bloody place can't bear the idea of anyone purchasing their product anonymously.

That said... I will not use any retailer, food or otherwise, who both maintain a physical retail space and require me to use a mobile phone to purchase things.

I know other people's tastes differ. These are mine.

[Bebu sa Ware]

"the idea of anyone purchasing their product anonymously."

And then complain about the legions of the William Wagglestaffs, Bertie Woosters and fellow travellers purchasing their precious products.

Not that the Bard in his darkest moments would ever have deigned to dine at a McDonalds caravanserai.

When I must have such an account I spin off another gmail account with hopefully a unique or at least peculiar or whimsical name (like this one actually.)

The idea that no one really needs to know everything about anyone is an anathema to these clowns when in the final analysis both parties a far better off knowing as little as possible about each other - only enough to complete the transaction with the details retained for no more that the minimal time required.

[I ain't Spartacus]

Re: "the idea of anyone purchasing their product anonymously."

I've got a new idea for a false name to use. Or I could possibly even use it as a password.... Came across it in a history podcast (David Crowther's excellent History of England). He's a property developer of dubious morals, who helped rebuild London after the great fire. Rejoicing in the name of If-Jesus-Christ-had-not-died-for-thee-thou-hadst-been-damned Barebone. Sometime spelled Barbon - and he seems to have gone by Nicholas, as his baptismal name was a teensy bit of a mouthful...

His father was Praise-God Barebone (whom the Barebones Parliament was named after).

[Far out man]

Re: Insanity

This makes me wonder what the Donalds password is, as he is reported to like this stuff.

[Winkypop]

Re: Insanity

“BigCheeseSmallFries”

[Pickle Rick]

Re: Insanity

Password Hint: Everyone's talking about it! DJT

[DrXym]

On the flipside

The McDonalds apps insists on 2FA just so I can avail of some stupid hamburger deal. If there was any reason their app had to be protected for some niche reason (e.g maybe some people order through the app) they should protect that rather than the innocuous stuff, i.e. Sometimes security has to be proportionate to what it is protecting.

[NoneSuch]

Re: On the flipside

"Sometimes security has to be proportionate to what it is protecting."

And when it comes to your wallet, I'd say that was worth protecting.

[MachDiamond]

Re: On the flipside

"And when it comes to your wallet, I'd say that was worth protecting."

So maybe it's much safer to just pay cash when you are keen on poisoning yourself.

"Double/Double with grilled onions, light tomato and a large pink lemonade". No fries, but it would be great if you started selling cookies, Lynsee!

[Pickle Rick]

Re: On the flipside

> Lynsee

Didn't she used to work down the local restaurant? Nice lady. A waitress, no QR code IIRC. Just cash you say? :D

[MachDiamond]

Re: On the flipside

"Didn't she used to work down the local restaurant? "

The owner/CEO of In-N-Out Burger. The richest woman in Tennessee.

[DoctorPaul]

Re: On the flipside

Ah, recall seeing their ads occasionally whilst catching up with NHRA drag racing from the States.

What a name! Always conjures up unfortunate mental images of the Out part of the process for me.

[DrXym]

Re: On the flipside

I haven't entered any credit card details into my McDonalds app so my wallet is quite safe. Attempting to login to get a discount off a burger is not something that should require having to check email for a code to paste into the other window. Aside from anything else it means I'm wasting an extra minute at the kiosk for no benefit to McDonalds.

And if there was something of value in the app, e.g. Monopoly tokens, the simple answer is to surround that stuff with the 2FA.

[MachDiamond]

Re: On the flipside

"I haven't entered any credit card details into my McDonalds app so my wallet is quite safe."

Your data is worth more than your payment details.

[DrXym]

Re: On the flipside

What data???? All there is in the McDonalds app is discount vouchers and occasionally promotions. I had to double check there and there is NO WAY to put any payment information in there. There is literally nothing of value to protect beyond the login email address and the most basic of information.

So the 2FA is just pointless, at least for retrieving the vouchers.

[M.V. Lipvig]

Re: On the flipside

Did you check what permissions the app needs to run? Usually location at a minimum, with some apps wanting access to your microphone and contact list even when there's no reason for the app to have this stuff.

[Jou (Mxyzptlk)]

Re: On the flipside

Why needing an McD app to purchase anyway! Just walk there with your online wallet or card, beep, done. Doesn't USA just switched to a new variant of that? No not apple, not paypal... Dmnt I don't have that name at hand since outside... I Germany your normal credit card from your bank is: hover, beep, done.

[MachDiamond]

Re: On the flipside

"Just walk there with your online wallet or card, beep, done. "

Cash, always cash. When your digital payments file is "leaked" or "Shared with partners", you don't want your history of fast food purchases to show up somewhere.

[Jou (Mxyzptlk)]

Re: On the flipside

Cash works in Europe, and especially Germany. But not all parts of the world are so far behind. I like the debit-card way (not Visa/Master etc, from the bank, EU style). Scandinavian countries were fastest to adopt.

[Uh, Mike]

Ho Hum

A) So McDonald's sudden interest in password security includes looking at the passwords. Bork!

B) I don't care if someone were to use my McD account to order food that they pay for.

C) Garbage in.

[Pickle Rick]

Re: Ho Hum

> So McDonald's sudden interest in password security includes looking at the passwords. Bork!

I think you might have misunderstood. They looked at known compromised passwords. eg. "bigmac"

>> Drawing on data from Have I Been Pwned, McDonald's said...

[Anonymous Coward]

Re: Ho Hum

I expect something else may be afoot though ... for example "From May 1, 2026, advertisements for meat products [and] fossil fuel-related products will be banned on the streets of Amsterdam". When this happened for tobacco products some time ago, cigarette companies started advertising for brand name matches instead (eg. Pall Mall Allumettes). What you're seeing may not be ads for password hygiene at all but indirect reminders to 'enjoy' their (mystery) meaty products named 'bigmac', 'nugget', and the likes...

Also interesting about MickeyDs in the Netherlands was their genAI output "the most terrible time of the year" Christmas ad this past December, that they had to pull after 4 days (approx.) due to multifaceted public uproar. Wuz probably another way to remind people that they exist (no such thing as bad publicity apparently).

[PRR]

Re: Ho Hum

> So McDonald's sudden interest in password security includes looking at the passwords.

So can you, or anybody. "Drawing on data from Have I Been Pwned, McDonald's said...."

It may be narcissistic to look for yourself in Have I Been Pwned, like Googling yourself, but it's not a security breech.

EDIT: ninjaed 3 minutes by Pickle Rick.

[Pickle Rick]

Re: Ho Hum

> It may be narcissistic to look for yourself in Have I Been Pwned

For a good number of commentards I'd say it's professional due diligence.

> EDIT: ninjaed 3 minutes by Pickle Rick.

Ninjas! They're everywhere!

[PRR]

Best password is no password?

Long ago, when dial-up was precious, the university made us log-in on the dial-up servers. Keep the non-matriculated riff-raff out. This was very important to them!

I was helping Floyd with another problem and asked him to connect.

Flink-flink he was in! I was logging into dialup a dozen times a day and I knew he could not type that fast.

He explained that when it prompted "PASSWORD?" he could just press ENTER and he was in.

When I tracked down who was in charge of the dial-ups he was like OMG WTF and thanked me profusely.

[Claptrap314]

Re: Best password is no password?

Yeah, that was actually a common failure last century. So common that WIndows implemented at least a couple versions of it, as I recall.

[MachDiamond]

Re: Best password is no password?

"He explained that when it prompted "PASSWORD?" he could just press ENTER and he was in."

I like that being a default since so many things have passwords for no visible reason. If somebody steals my comp from home and now has physical access and lots of time, game over. I like that I can just leave the default in place and hit "return" to bypass the login. I do have startup passwords, some sensitive things are encrypted and a few things reside in hidden folders.

[Jou (Mxyzptlk)]

Re: Best password is no password?

But you are encrypted, are you? Password to boot the encrypted system partition...

[Anonymous Coward]

Goes with the territory

If you are a frequent purveyor of Maccas, then you probably don’t care about too much.

[strebling]

I pasted Ch!ck3nMcN4gg€t$ into https://www.security.org/how-secure-is-my-password/ and it says it would take a computer 1 trillion years to crack it...

[David Hicklin]

Looking at your substitutions I was not aware of a "u" becoming a "4", so that might add a few million years to it, and as for the poor old €, I mean how many people use that for an e ?

[Jou (Mxyzptlk)]

Ehm, you know, European union? Heard of it? The € came before y2k... Even MS-DOS got an € update... In what strange self-enclosed bubble are you living in?

[Gavsky]

"McDonald'sMurdersCows" is already verboten...

[M.V. Lipvig]

My password is

McPenguinBurgersExtraLettu¢eSpecialOrdersDon'tUpsetUs1

Before that it was

MayorM¢CheeseWithExtraKetchup2

Heh heh, no, neither is really my password because I don't have one. I haven't been to McPukeys in 30 years. I stopped eating there not long after the styrofoam clamshells went away.