3 ms·
>"i instead for whatever reason used the values the document had." >They put full access plaintext credentials for their production database in their tutorial
by xoa 9y ago
>"i instead for whatever reason used the values the document had."
>They put full access plaintext credentials for their production database in their tutorial documentation
WHAT THE HELL. Wow. I'd be shocked at that sort of thing being written out in a non-secure setting, like, anywhere, at all, never mind in freaking documentation. Making sure examples in documentation are never real and will hard fail if anyone tries to use them directly is not some new idea, heck there's an entire IETF RFC (#2606) devoted to reserving TLDs specifically for testing and example usage. Just mind blowing, and yeah there are plenty of WTFs there that have already been commented on in terms of backups, general authentication, etc. But even above all that, if those credentials had full access then "merely" having their entire db deleted might even have been a good case scenario vs having the entire thing stolen which seems quite likely if their auth is nothing more then a name/pass and they're letting credentials float around like that.
It's a real bummer this guy had such an utterly awful first day on a first job, particularly since he said he engaged in a huge move and sunk quite a bit of personal capital from the sound of it in taking that job. At the same time that sounds like a pretty shocking place to work and it might have taught a ton of bad habits. I don't think it's salvageable but I'm not even sure he should try, they likely had every right to fire him but threatening him at all with "legal" for that is very unprofessional and dickish. I hope he'll be able to bounce back and actually end up in a much better position a decade down the line, having some unusually strong caution and extra care baked into him at a very junior level.
- ncantelmo 9y agoThere's also a high chance that document was shared on Slack. In which case, they were one Slack breach away from the entire world having write access to their prod database. It's depressing how many companies blindly throw unencrypted credentials around like this.
- kefka 9y agoTell me about it. Fortunately where I work is sane and reasonable about it. We have a password sheet. You have to be on the VPN(login/password). Then you can log in. Login/Password(diff from above)/2nd password+OTP. Then a password sheet password. I'm still rooting out passwords from our repo with goobers putting creds in sourcecode (yeah, not config files....grrrrr). But I attack them as I find them. Ive only found 1 root password for a DB in there... and thankfully changed!
- posixplz 9y agoA plaintext password sheet? Despite the layers of network access control, this is a horribly bad practice in our modern age. Vault is free and encrypted secret storage systems are hardly a new concept.
- kefka 9y agoNot at all. The password sheet password is actually a GPG key. Everything stored encrypted. We suffer from NIH greatly. We end rolling our own stuff because either we don't trust 3rd party stuff, or it doesn't work in our infrastructure. In this case, multiple access locks with GPG is sufficient.
- posixplz 9y agoA response 8 days later is better than no response at all, right? :) I agree that a multi-recipient GPG protected file is sufficient for a small org. In fact, that's how I used to do it Circa 2011. We found it worked quite well - we committed the GPG protected files to a version control system (git) and used githooks to make sure that only encrypted files were permitted, preventing users from intentionally/accidentally defeating gitignore.
- tayo42 9y agoSlack getting hacked would definitely be a mess. There's going to be so many cloud credentials, passwords, keys, customer info...
- CodeWriter23 9y agoThe document is probably in Google Docs too.
- RugnirViking 9y agoThe exact same slack that he remained in for several hours after being fired. Even worse way to provoke a response from a disgruntled employee...
- deleted 9y ago[deleted]