4 ms·
Uber's story doesn't make any sense. In what world does "you published your passwords on GitHub" get a response of "prove it by using them"?
by daveFNbuck 9y ago
Uber's story doesn't make any sense. In what world does "you published your passwords on GitHub" get a response of "prove it by using them"?
- monocasa 9y agoIDK, it seems to fit the frat bro culture I've come to expect out of Uber. "Oh yeah? Then fucking do it then", seems fairly Uber.
- whack 9y agoIn any sufficiently large corporation, there are so many different accounts/credentials floating around, that it's hard for anyone to keep track of them all. It's possible that the engineering team may have already invalidated the credentials that were published on GitHub. It's possible that those credentials were actually a bait, meant specifically to distract potential hackers. Asking for proof is a very quick and easy (and sloppy) way to get around all of the above.
- daveFNbuck 9y agoPrivate user information isn't proof that valid credentials were published on GitHub. It would be faster and easier to ask for actual proof in the form of a link to a valid credential published on GitHub, and that would actually prove that they were published.