Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you should store passwords in plaintext

qword.net

Post reply on HN
Print view View original

31–40 of 147 posts

Re: Maybe you should store passwords in plaintext

#31

Post by furyofantares »

Good security practices are in this unfortunate category where:

1) The actual risk calculation is somewhat nuanced, but advocates are very clearly on the right side when you do it.

2) The advocates drastically oversell it as a coping mechanism for it being hard to convey nuanced issues, and even come to believe their overselling.

3) Some who go along at first gradually gain some intuition that they've been lied to, and wrongly conclude or begin to behave as if the advocates are on the wrong side.

In the case of storing passwords in plaintext, it causes a low probability increase in chance of a some very bad outcomes.

It can be correct that it's well worth mitigating, while also being a hard calculation to reason about and find salient. If we compensate by treating it as if it's a high probability event in order to get everyone t comply, and begin to believe it ourselves, people may eventually notice that not everyone is compliant, but they never see anything bad happen in their immediate surroundings, become increasingly lax themselves, notice nothing bad is happening still, etc.

Seatbelts are maybe a counterexample to my point here, where people have come around despite their personal experience never including an accident. Maybe with the help of laws, or maybe more because it's personal risk to self. Or maybe it's just that enough people know someone who has had a bad car accident even if they haven't themselves.

Re: Maybe you should store passwords in plaintext

#32

Post by jerrygenser »

Sorry this isn't the purpose of the original article, but does anyone want to give a way secrete should be stored? Even if I use secrets manager for example, I need to store the token for fetching it so there is always a secret or token that needs to be stored.

I might not store an access token, I might use user auth and get a temporary token for a script that then calls to a secret manager. The access token is cached locally in plain text. Is tbis more secure since it's a token with expiry?

Re: Maybe you should store passwords in plaintext

#33

Post by Gigachad »

TheDong wrote: post #23
SoftTalker wrote: post #12

My eyes really opened to this during the pandemic and its aftermath. Working from home I did almost nothing productive. Got paid the same. Returning to the office, I noticed half the people still seemed to be working from home most days, so I started doing that too. And did almost nothing productive. Nobody apparently noticed or cared. Got paid the same. Got the same raise (yes, below inflation). So now I have given…

I don't think that sort of strategy can work for everyone because there's two possible negative mental outcomes in there too. First, some people will feel that they're "cheating" and don't deserve the paycheck because they're intentionally working less. That feeling can be worse than the benefit of having more time. Second, some people have too much of a sense of personal pride to do that sort of "quiet quitting". Th…

I get this feeling. When I get through a day where I’m not blocked on anything I feel satisfied and happy. If I have to wait half the day for someone to reply and I just watch YouTube in that time, it feels bad. Not even that I’m “cheating” but that it was just a waste of time.

Re: Maybe you should store passwords in plaintext

#34

Post by evilspammer »

shric wrote: post #11

“You don’t get rewarded for being extra. You don’t get any money when you save costs. You’re going to get a raise below inflation. You’re stupid for caring the way that you do. The business’ downside risk is not yours, and it’s profits are not yours either.” Except when you're granted RSUs or participate in some private company's profit sharing scheme. So if that's important to you, find such a place. The smaller the…

The smaller companies are probably not IPOed so the stock has no actual value

Re: Maybe you should store passwords in plaintext

#35

Post by [deleted] »

DougN7 wrote: post #17
throwawaysleep wrote: post #2

I am basically that employee in several ways. I know about wasteful cloud spend that I do nothing about. My last comment on HN actually was asking if anyone could give me a reason to report that cloud waste. The best arguments were for the sake of the environment and to build credibility with co-workers to make it easier to jump ship. Nothing from the company at all. I can't say I deliberately ship bugs, but I don't…

I’m hanging onto this post for the next time I see people on their high horse about integrity among engineers. The fact is, some people have it and some don’t, regardless of job. This makes me sad. Economically it makes sense, but it’s a sign of the sickness in our modern society. Everyone looking out for themselves first without much thought to the community around them. I say this having been burned by employees li…

[deleted]

Re: Maybe you should store passwords in plaintext

#36

Post by ripplefringe »

Something that I feel like I disagree with here is that it doesn't take into account all the intangibles that you get from working hard. Personally I work hard and I feel like I get:

* Appreciation from my manager and team, who I respect and love working with. * New knowledge that I can use later, and possibly build trust with others. * Influence that I can use later * The good feeling knowing I solved a problem for my business and hopefully letting them spend that money or effort elsewhere. * Some sense of job security

This is probably a very Pollyanna view of the world, and maybe it's all because I have a good team and manager. But nevertheless, I feel like I hit the lottery as a programmer. It's enjoyable, the work changes day-to-day and it pays well.

Re: Maybe you should store passwords in plaintext

#37

Post by paulcole »

geraldwhen wrote: post #27
nobrains wrote: post #18

Earlier quoted context omitted.

This just means that your line manager, whose role it is to ensure all resources under them are working at efficient capacity, is not doing his/her job. And in turn neither is his manager.

The goal of a manager or worker isn’t to be efficient, it’s to produce value. I suspect the diminishing returns of effort at most companies is astonishingly high. I would much rather a developer work 10 hours and accomplish what needs to get done than work 40 and negatively impact the business.

> I would much rather a developer work 10 hours and accomplish what needs to get done than work 40 and negatively impact the business.

It feels like there is a third option here that I can’t quite put my finger on.

Re: Maybe you should store passwords in plaintext

#38

Post by cardanome »

It really depends where you work, you role and what the incentives are.

You are young and working in a small startup with revenue share? Yeah, go wild and try to leave your mark! Just avoid getting burned out!

Boring corporate job and have family to feed? Don't rock the boat.

Though generally, don't. Best case you will make other people richer. Worst case is it backfires and you get more work assigned.

If you want to advance your career, work on your social skills. If people like you they will automatically rate your job performance highly. Conversely your programming skills are pretty worthless if nobody wants to work with you.

Might be cynical but that is how it works.

Re: Maybe you should store passwords in plaintext

#40

Post by aaomidi »

geraldwhen wrote: post #27
nobrains wrote: post #18

Earlier quoted context omitted.

This just means that your line manager, whose role it is to ensure all resources under them are working at efficient capacity, is not doing his/her job. And in turn neither is his manager.

The goal of a manager or worker isn’t to be efficient, it’s to produce value. I suspect the diminishing returns of effort at most companies is astonishingly high. I would much rather a developer work 10 hours and accomplish what needs to get done than work 40 and negatively impact the business.

The funny thing is, that extra working does actually negatively impact the business at least in the software world.

People seemingly end up having a lot more time for _defining processes_.

There are people at nearly every large company I’ve worked on that so more meta work, and sometimes demand more meta work than actual work.

Like there are folks that are actively costing productivity in exchange for the meta work.

I’ve challenged them to actually back the work they’re doing with data and how it’s actually helpful and generally there’s no follow up. It’s amazing.

Post reply on HN