41–50 of 53 posts
It too contains the password "e5p0nd4". This user didn't do any hacking or googling but got this error browsing facebook. He says "Suddenly I got this error message in Facebook" (so apparently inside the production environment, wtf?).
[1] https://forums.digitalpoint.com/threads/facebook-error-messa...
[2] http://www.zyngaplayerforums.com/archive/index.php/t-545034-... - Another one from 2010!
Earlier quoted context omitted.
A password means you can't access the database server from a mail server or file server. Complex environments have more than just a database server and a few web servers.
That's why my pg_hba.conf is configured to only allow app servers passwordless access.
fascinating stuff. I'm still amazed at how many username/passwords are freely available via github search: https://github.com/search?p=96&q=gmail+password&ref=searchre... even if they have 2-step auth setup, people choose "complete the email address" as a form of authentication which you can most likely get from their github profile. the moral of the story here is - if you do not want someone to find it - do not publ…
https://github.com/Dao007forever/Linux-settings/blob/master/...
https://github.com/Dao007forever/Linux-settings/blob/master/...
https://github.com/Dao007forever/Linux-settings/blob/master/...
> the moral of the story here is - if you do not want someone to find it - do not publish it online
I doubt it's intentional. I will note that on Windows, if you're using ActiveDirectory, it's much more difficult to make this kind of mistake.
Somewhat ominous for top HN users: http://pastebin.com/6GeZnS9b
This was someone's attempt at a bitcoin public challenge: https://news.ycombinator.com/item?id=6765801 (Get a wallet's passphrase which was the username of someone in the Hacker News top 100, minus 2 characters).
Mostly as I gave up ever trying to do anything with Bitcoin because I simply can't get my head around any of the practicalities, lol, so it definitely wasn't anything of mine! ;-)
Earlier quoted context omitted.
We have an internal pastebin, it's built into Phabricator. There is no preset format for unixnames. Most people use their names but I've seen many pseudonyms. One intern famously broke some internal tools by requesting her initials, which were "www".
I broke more than my fair share of systems by using "Roger Oot" as my goto pseudonym.
Tangentially related, I'd like an opinion on this: >Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password. What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password. That means that an attacker who g…
Fuck-ups happen, and an insecure password does a good job of preventing any activity that doesn't explicitly include the password.
Like, suppose you have some dev tool that does things to a database. If your local dev environment does not have a password on the db, and the application environment does, odds are your tool is going to work locally but not in the application environment.
Basically, it can be a form of "type 'password1' if you are sure you want to do things to prod".