In my experience password protected files are often password protected for obscure reasons which have nothing to do with the intent of keeping them secret, like:

- prevent anti virus from messing with it

- keep to some obscure regulations wrt. Contacts or law, where is enough if you can argue the data was encrypted.

If you make zip files in a company, there is never a repository of passwords, because that would be insecure, ergo zip files with other passwords usually are not easy to unzip after 5-10 years when the owner is dead/gone and the passwords are lost.

This type of passwords are use in almost all big corporations. People are being asked to encrypt things but without password managers or keys management tools.

Yeah, I know of plenty of other companies with similar multi-time-use passwords. The data in that zip file probably isn't that confidential.

> People are being asked to encrypt things but without password managers or keys management tools.

That doesn't really make me think better of the company; if the company fails to support secure workflows, it's still on them when people fail to use secure workflows.

It’s mentioned in the Twitter thread that at least some of the files have a password of “I accept” instead. That leads me to believe that the primary purpose might just be to indicate agreement to an NDA.

The number one (by a wide margin) reason for Intel123 is that somebody is trying to email a zip to somebody else, but a mandatory filter notices "bad files" (oh no, executables!) inside the zip and removes it to keep people "safe". So the zip gets a common, known password, and the recipient gets their files in peace. It's not a security measure at all. It's a workaround for braindead IT "solutions" hindering day-to-day operations. The files can be shared via any number non-encrypted channels just fine, but the particular employees trying to share happen to be most familiar with email and the filter doesn't know or care if there are secrets - there are EXECUTABLES! Those are dangerous, don't you know?

The primary use case for such passwords is not confidentiality. It is to bypass overzealous email virus checkers.

For the life of me, I can't understand why people insist on making passwords with the name of the company in them. It's so absolutely stupid, but common.

Internal marketing