Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you should store passwords in plaintext

qword.net

Post reply on HN
Print view View original

61–70 of 147 posts

Re: Maybe you should store passwords in plaintext

#61

Post by orwin »

xiaodai wrote: post #52

I am a chump. I've SEEN passwords in plaintext and I even tried to remove it by figuring out how to remove it from git histories. Heck, for one of those where it was not possible to get rid of plaintext due to the architecture, I even wrote some code to compare hashes instead of password so at least the attacker would need a rainbow table to crack it. Didn't bother salting it, since there's only one user effectively.…

The best way is to change the password in the environments, and let it in the commit history. It's both the easiest and the correct way.

And if you can't, your company have to change its architecture.

Re: Maybe you should store passwords in plaintext

#62

Post by RangerScience »

> Is there some way to correct this? How do you reward good behaviour here, and discourage “misbehavior” like this?

…Yes? As the employer, find ways to be as generous and rewarding as possible. In immortal other words, “Fuck uou pay me.”

Every example provided was “I went above and beyond and was not rewarded for it.”

The fix is rewarding people for it.

Re: Maybe you should store passwords in plaintext

#63

Post by pierat »

smsm42 wrote: post #44
SoftTalker wrote: post #12

My eyes really opened to this during the pandemic and its aftermath. Working from home I did almost nothing productive. Got paid the same. Returning to the office, I noticed half the people still seemed to be working from home most days, so I started doing that too. And did almost nothing productive. Nobody apparently noticed or cared. Got paid the same. Got the same raise (yes, below inflation). So now I have given…

Do you shoplift? Serious question. Shoplifting is rarely caught, and even more rarely prosecuted in many major cities (e.g. SF). While you probably won't be able to steal anything high value, there's a lot of things you'd be able to steal without being caught, and why pay for something if you can have it for free? Most grocery stores are owned by billion-dollar corporations, which don't hesitate to raise prices, enga…

Go look up banana trick, aka PLU 4011.

This shoplifting joke is thanks to the replacement of humans with these terrible self(aka unpaid) scan machines.

Stuff gets put in as bananas, and then weighed. You pay $.29/lb for whatever. And this works beautifully for high price stuff like steaks and the like.

Not that I advocate physical theft, but it's definitely a thing. And it's a thing where more people are being screwed. I sure as hell don't get a "you scan it" discount, officially.

https://losspreventionmedia.com/the-banana-trick-and-other-a...

And there's plenty other 'tricks' aka shoplifting that can be done to little risk, primarily due to companies fucking customers over by making us unpaid employees.

Excuse me while I cry an alligator tear for them

Edit: tough crowd, I see. You all don't get it. Shoplifting has increased by like 600% because companies are getting rid of cashiers. It's corporate greed is what's allowing shoplifting with the thin veneer of 'legitimacy' to happen. (Legitimacy of 'i scanned it but oh well, wrong barcode/plu.)

And I find it funny, because corporate greed is triggering revenge shoplifting, for customers being forced to be unpaid employees. And the u-scan-its are basically idiot jackpot machines with anyone with low ethics.

Re: Maybe you should store passwords in plaintext

#66

Post by kapp_in_life »

selcuka wrote: post #41
kapp_in_life wrote: post #22

The incentive to not act like the slackers is how it impacts your "network". It's pretty insufferable to work with these people, when the success of your project depends on them or their team for whatever reason. If our team is hiring and I see a former coworker got laid off who was a slacker I won't put in a referral for them. I guess it won't impact them much, because tech is still growing and demand exceeds supply…

From the article: > [they] say their new goal is to be “perfectly mediocre.” Note that mediocre is not the same as slacker. It is impossible to distinguish a genuinely mediocre developer from an intentionally mediocre one, so no, it won't impact their network unless they are really careless and tell everyone that they can in fact perform better. Do you stop talking to a colleague because they have never found a secur…

The 4 case examples in the article are absolutely slackers. Not mentioning a 6 figure cloud inefficiency, or knowingly shipping bugs, or leaving 100's of diffs for compiler warnings and not publishing them.

You're right about not being able to tell a genuinely mediocre developer from an intentionally mediocre one... unless they tell on themselves like the above did.

>Do you stop talking to a colleague because they have never found a security vulnerability and fixed it?

This feels like a reach? Obviously not, I'm perfectly cordial to everyone I work with. If they find a security vulnerability, and don't fix or even bother reporting it then I'll obviously think less of them and probably not give them a referral. But I'd never hold it against someone for not identifying one or accidentally shipping one.

Re: Maybe you should store passwords in plaintext

#67

Post by selcuka »

kapp_in_life wrote: post #66
selcuka wrote: post #41

Earlier quoted context omitted.

From the article: > [they] say their new goal is to be “perfectly mediocre.” Note that mediocre is not the same as slacker. It is impossible to distinguish a genuinely mediocre developer from an intentionally mediocre one, so no, it won't impact their network unless they are really careless and tell everyone that they can in fact perform better. Do you stop talking to a colleague because they have never found a secur…

The 4 case examples in the article are absolutely slackers. Not mentioning a 6 figure cloud inefficiency, or knowingly shipping bugs, or leaving 100's of diffs for compiler warnings and not publishing them. You're right about not being able to tell a genuinely mediocre developer from an intentionally mediocre one... unless they tell on themselves like the above did. >Do you stop talking to a colleague because they ha…

> This feels like a reach? Obviously not, I'm perfectly cordial to everyone I work with.

Sorry if you were offended, but I didn't mean that you do. Nobody does. That was a rhetorical question to emphasise my point.

Re: Maybe you should store passwords in plaintext

#68

Post by TheDong »

SoftTalker wrote: post #47
TheDong wrote: post #23

Earlier quoted context omitted.

I don't think that sort of strategy can work for everyone because there's two possible negative mental outcomes in there too. First, some people will feel that they're "cheating" and don't deserve the paycheck because they're intentionally working less. That feeling can be worse than the benefit of having more time. Second, some people have too much of a sense of personal pride to do that sort of "quiet quitting". Th…

I didn't say I felt good about it. But I don't feel bad about it either. I do what I'm asked to do, just nothing more. As far as pride goes, what I do I do well, or at least to the best of my ability. I don't sabotage anything. Based on reviews of my work and absent any criticism, my employer seems to feel they are getting what they are paying for.

I'm not claiming you are sabotaging things or going out of your way to do poor work, that's a given.

However, based on your phrasing, you make it clear you're intentionally putting in less work than you could, and recognize it's less than your employer assumes you are.

You didn't say "Even if I tell my boss I finished my work, there aren't more tickets", you phrased it as "do the least amount necessary, and ignore everything else".

That last sentiment is the thing I'm saying not everyone can do, the thing that may mentally be worse than the benefit.

As above, good on your for having a relationship with work where you can do that. It seems healthy.

Re: Maybe you should store passwords in plaintext

#69

Post by scott00 »

jerrygenser wrote: post #32

Sorry this isn't the purpose of the original article, but does anyone want to give a way secrete should be stored? Even if I use secrets manager for example, I need to store the token for fetching it so there is always a secret or token that needs to be stored. I might not store an access token, I might use user auth and get a temporary token for a script that then calls to a secret manager. The access token is cache…

Your guess is correct, the expiration is what adds the security.

The main security need this is addressing is terminating access to ex-employees/contractors given a requirement for shared credentials. If the shared credentials are not short term, you have to rotate credentials every time the team changes. If you don't have a system to do it automatically it's pretty easy to forget to do it or do it incompletely. So better just to do it very frequently and automatically so you don't even need to bother with a revocation process.

You might be thinking that you don't have any shared credentials, but effectively any credential that a server has access to is shared, because there's almost certainly at least two people with access to any given server.

Re: Maybe you should store passwords in plaintext

#70

Post by Gigachad »

pierat wrote: post #63
smsm42 wrote: post #44

Earlier quoted context omitted.

Do you shoplift? Serious question. Shoplifting is rarely caught, and even more rarely prosecuted in many major cities (e.g. SF). While you probably won't be able to steal anything high value, there's a lot of things you'd be able to steal without being caught, and why pay for something if you can have it for free? Most grocery stores are owned by billion-dollar corporations, which don't hesitate to raise prices, enga…

Go look up banana trick, aka PLU 4011. This shoplifting joke is thanks to the replacement of humans with these terrible self(aka unpaid) scan machines. Stuff gets put in as bananas, and then weighed. You pay $.29/lb for whatever. And this works beautifully for high price stuff like steaks and the like. Not that I advocate physical theft, but it's definitely a thing. And it's a thing where more people are being screwe…

In Australia the supermarkets use cameras pointed at the scanner and AI to visually match items. When you scan a steak as bananas, it notices something isn't right, puts an image of the item you weighed, and the item you selected on screen and flags a staff member to verify it.

As a nice bonus, when you open the selection menu, it has the item you want shown up front so you don't have to search for it most of the time.

Post reply on HN