4 ms·
> And I can think of more than one well-regarded unicorn where everyone still has access to basically everything, even after their first or second bad security
by acconsta 11y ago
> And I can think of more than one well-regarded unicorn where everyone still has access to basically everything, even after their first or second bad security breach.
Which companies? That's pretty scary.
- bpchaps 11y agoI used to work for a major financial exchange like this. When I joined, the root password was known by /everyone/. They also used telnet instead of ssh. Another company I worked for used rot13 for their back end risk management system's password storage. Found it completely by accident when trying to add the platform I was supporting at the time. I had a setting to the effect of 'resolve data from defined functions' enabled, so every password stored would be resolved to plaintext instead of showing their 'hashes'. It was batshit scary - scariest being the production r/w credentials for the credit card and mortgage databases. When I reported that one to the devs, they responded with, "We know. We needed to push the code out as quickly as possible, so we got lazy". Fuck. That.
- cfcef 11y agoCould be Instagram, judging by that recent security writeup...