Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you should store passwords in plaintext

qword.net

Post reply on HN
Print view View original

71–80 of 147 posts

Re: Maybe you should store passwords in plaintext

#71

Post by pierat »

Gigachad wrote: post #33
TheDong wrote: post #23

Earlier quoted context omitted.

I don't think that sort of strategy can work for everyone because there's two possible negative mental outcomes in there too. First, some people will feel that they're "cheating" and don't deserve the paycheck because they're intentionally working less. That feeling can be worse than the benefit of having more time. Second, some people have too much of a sense of personal pride to do that sort of "quiet quitting". Th…

I get this feeling. When I get through a day where I’m not blocked on anything I feel satisfied and happy. If I have to wait half the day for someone to reply and I just watch YouTube in that time, it feels bad. Not even that I’m “cheating” but that it was just a waste of time.

Ah, when that happens for me, I keep trying to learn new things. I call it professional development.

And that's served me well too. Every time I job hop, I already have that "hot new skill in demand" along with 30+% salary increase.

And I don't feel bad one bit. I know that every job 'takes advantage' of me and my worth, since by definition, capitalist companies will ALWAYS keep the surplus of my labor. I will never see 100% of my efforts when working for others.

Do I have to take part in the system? Well, I like eating and living in a home, and these life things. And those are implicitly threatened and me blamed if I don't. So I play the "game". I certainly wasn't born in a family I didn't have to play that game.

Re: Maybe you should store passwords in plaintext

#72

Post by Gigachad »

tsukikage wrote: post #9
throwawaysleep wrote: post #2

I am basically that employee in several ways. I know about wasteful cloud spend that I do nothing about. My last comment on HN actually was asking if anyone could give me a reason to report that cloud waste. The best arguments were for the sake of the environment and to build credibility with co-workers to make it easier to jump ship. Nothing from the company at all. I can't say I deliberately ship bugs, but I don't…

If your employer doesn't reward its employees for doing things that benefit the bottom line, it's perhaps time to look for another employer.

Or maybe the company has identified that their bottom line would be improved more by working on other things rather than the relatively small cloud waste.

Re: Maybe you should store passwords in plaintext

#73

Post by 121789 »

andrewmcwatters wrote: post #14

I agree with Nihilartikel’s comment. It’s nice when you’re the one doing business development. But as a manager at any organization, the correct answer is to fire people like this because they become insidious and take over your business. Have a moral backbone. Is it fair? No. Lots of corporate decision making will never ever be fair. Deal with it, or work with these people. Find ways to financially incentivize moral…

Managers are not somehow exempt from this line of thinking. Firing someone is labor intensive for a manager and will actually reduce their power. No one wants to fire anyone, especially lately.

This is clearly the result of corporations destroying workers’ incentive to produce quality work. If you don’t pay people to care, they will not care

Re: Maybe you should store passwords in plaintext

#74

Post by justsomehnguy »

>> "They pretend to pay and we pretend to work"

I have a monitoring instance which monitors a couple of URLs of some client. Every now and then something is wrong somewhere and it's spams the messenger with 'not available'. In a minute it spams again, now with 'Resolved' status. I can just turn the trigger time to two minutes or change it to trigger only after a two/three consecutive failed checks... But should I?

Not only it wouldn't change how much I receive for this service (a pint of Guinness/mo, really), but it also would make it look like the monitoring isn't monitoring. I don't want to make proofs what it's actually working.

Bonus point: if I receive the alerts I know what the monitoring works.

And to the TFA: I made a proper VPN network for a client a decade ago: a VPN concentrator, dual path through two ISPs to the main office with the on-premise services, 15+ branches in the city, a couple of remote ones. Except I didn't buy Cisco gear, but some, ugh, not quite enterprise gear running FOSS solutions. Did I got anything from it? OFC no.

Re: Maybe you should store passwords in plaintext

#75

Post by bexsella »

Gigachad wrote: post #70
pierat wrote: post #63

Earlier quoted context omitted.

Go look up banana trick, aka PLU 4011. This shoplifting joke is thanks to the replacement of humans with these terrible self(aka unpaid) scan machines. Stuff gets put in as bananas, and then weighed. You pay $.29/lb for whatever. And this works beautifully for high price stuff like steaks and the like. Not that I advocate physical theft, but it's definitely a thing. And it's a thing where more people are being screwe…

In Australia the supermarkets use cameras pointed at the scanner and AI to visually match items. When you scan a steak as bananas, it notices something isn't right, puts an image of the item you weighed, and the item you selected on screen and flags a staff member to verify it. As a nice bonus, when you open the selection menu, it has the item you want shown up front so you don't have to search for it most of the tim…

What I like about this system is that every time I've ever encountered this it's always been a laughable error. The last time, I weighed a carrot and it reported that I had actually weighed plums, despite the image clearly being orange and longer than most plums in a longest plum competition.

Re: Maybe you should store passwords in plaintext

#76

Post by hsbauauvhabzb »

jerrygenser wrote: post #32

Sorry this isn't the purpose of the original article, but does anyone want to give a way secrete should be stored? Even if I use secrets manager for example, I need to store the token for fetching it so there is always a secret or token that needs to be stored. I might not store an access token, I might use user auth and get a temporary token for a script that then calls to a secret manager. The access token is cache…

I’m personally not a huge fan of expiry - if your key is compromised within its lifetime, it can be compromised again, attack complexity increases but is not mitigated and requires a bunch more effort (refreshing, graceful fail logic, etc).

Windows implements DPAPI, which is used to encrypt stored secrets on disk keyed with the users password sha1’d (and previous sha1 keys encrypted with the newest password). That way a file system compromise isnt a password compromise, at least directly.

More hardcore is hardware based modules, TPM and yubikeys are in this space, they use pub/private keys so the secret is no longer pre shared. Other hardware security modules also exist which are more full fledged. The former ultimately guarantee authentication but not session security, the latter can potentially do both afaik.

Re: Maybe you should store passwords in plaintext

#77

Post by reustle »

pierat wrote: post #63
smsm42 wrote: post #44

Earlier quoted context omitted.

Do you shoplift? Serious question. Shoplifting is rarely caught, and even more rarely prosecuted in many major cities (e.g. SF). While you probably won't be able to steal anything high value, there's a lot of things you'd be able to steal without being caught, and why pay for something if you can have it for free? Most grocery stores are owned by billion-dollar corporations, which don't hesitate to raise prices, enga…

Go look up banana trick, aka PLU 4011. This shoplifting joke is thanks to the replacement of humans with these terrible self(aka unpaid) scan machines. Stuff gets put in as bananas, and then weighed. You pay $.29/lb for whatever. And this works beautifully for high price stuff like steaks and the like. Not that I advocate physical theft, but it's definitely a thing. And it's a thing where more people are being screwe…

> customers being forced to be unpaid employees

Do you consider yourself a forced unpaid employee when you go through the checkout screen on Amazon?

Re: Maybe you should store passwords in plaintext

#78

Post by hsbauauvhabzb »

throwawaysleep wrote: post #2

I am basically that employee in several ways. I know about wasteful cloud spend that I do nothing about. My last comment on HN actually was asking if anyone could give me a reason to report that cloud waste. The best arguments were for the sake of the environment and to build credibility with co-workers to make it easier to jump ship. Nothing from the company at all. I can't say I deliberately ship bugs, but I don't…

Sure would be funny if you were tossed under the bus for blatantly reducing the security of your org by using a previously compromised password. Bug bounty integrity isn’t the only issue that could land you in legal trouble.

Re: Maybe you should store passwords in plaintext

#79

Post by anotherhue »

reustle wrote: post #77
pierat wrote: post #63

Earlier quoted context omitted.

Go look up banana trick, aka PLU 4011. This shoplifting joke is thanks to the replacement of humans with these terrible self(aka unpaid) scan machines. Stuff gets put in as bananas, and then weighed. You pay $.29/lb for whatever. And this works beautifully for high price stuff like steaks and the like. Not that I advocate physical theft, but it's definitely a thing. And it's a thing where more people are being screwe…

> customers being forced to be unpaid employees Do you consider yourself a forced unpaid employee when you go through the checkout screen on Amazon?

That poster should look up what groceries stores used to look like...

Re: Maybe you should store passwords in plaintext

#80

Post by aaomidi »

tremon wrote: post #51
aaomidi wrote: post #40

Earlier quoted context omitted.

The funny thing is, that extra working does actually negatively impact the business at least in the software world. People seemingly end up having a lot more time for _defining processes_. There are people at nearly every large company I’ve worked on that so more meta work, and sometimes demand more meta work than actual work. Like there are folks that are actively costing productivity in exchange for the meta work.…

Ah yes, I've worked before with developers that believed that processes didn't matter. They produced amazing value, or so they thought. Except that... Half of what they did was never committed into git, because a software versioning process is for dummies. And the other half could only be found in a random feature branch, because they didn't need any review process, their code was always faultless. Whatever was runni…

If you read what I said a bit more carefully, you'd see that I specifically wanted to _measure_ what the outcome was and that there be data backed up with the processes being made.

I'm not talking about the use of git, etc. I'm not even talking about process in relation to the code either. It's process for tracking how we track projects. Like, that level of indirection.

Post reply on HN