5 ms·

I've worked for multiple Fortune 25 companies, and that excuse does not fly. Not in banking or healthcare, where breaches of privacy/confidentiality are actuall

by beat 8y ago

I've worked for multiple Fortune 25 companies, and that excuse does not fly. Not in banking or healthcare, where breaches of privacy/confidentiality are actually illegal, rather than merely distasteful. Small teams and careless devs doing that sort of bad logging will be caught and corrected by strict security oversight. This is the sort of thing that leads the HN crowd to sneer at the old, slow ways of the enterprise world.

deleted 8y ago
[deleted]
gjs278 8y ago
hey just so you know your https ssl certificate is broken for congruence.io so much for how careful you are with computers. it’s telling you worked for multiple fortune 25’s.
Aunche 8y ago
The passwords in plaintext wasn't a breach or a leak. If you punish Facebook for it, they would be less inclined to share such information in the future.
- tkxxx7 8y ago
  That's how you handle children, though. No one is going to ignore wrongdoings in hopes the perp will continue to play nicely.
- munk-a 8y ago
  If we can't trust a company to audit themselves fairly (in fact, we can't generally) then they should bear the burden of paying for an external audit of their processes, many "boring" industries have these sorts of requirements.
- jyrkesh 8y ago
  There might not have been a large-scale public data dump of passwords, but if 20,000[1] employees had access to logs with plaintext passwords, there is no guarantee I could ever accept that zero of them read or used customer passwords for personal purposes. What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plaintext, they very likely weren't auditing log access as much as was needed. [1] https://www.theverge.com/2019/3/21/18275837/facebook-plain-text-password-storage-hundreds-millions-users https://www.theverge.com/2019/3/21/18275837/facebook-plain-t...
  - UncleMeat 8y ago
    Malicious insiders don't need your password to access your data. If you are concerned about malicious insiders then plaintext password logs don't matter.
    - _jal 8y ago
      With FB's dataset and employee count, it would be insane not to be concerned with malicious insiders. Even if you completely discount morality and honesty where Facebook is concerned (and I do), there's substantial liability risk, PR risk, regulatory risk and commercial paranoia, which I suspect was likely their biggest concern, at least until recently.
    - beat 8y ago
      I'm more concerned with plaintext passwords because most people use the same passwords over and over, so if you can break one system, you can break others.
tempestn 8y ago
There's a dead sibling to my comment mentioning that your congruence.io website has an expired SSL certificate, fyi.
stubish 8y ago
There is no oversight in a Devops world. New systems come up in protoduction, celebrations are had, and the data protection officers and security compliance officers remain in blissful ignorance.

by beat 8y ago

deleted 8y ago

[deleted]

gjs278 8y ago

hey just so you know your https ssl certificate is broken for congruence.io so much for how careful you are with computers. it’s telling you worked for multiple fortune 25’s.

Aunche 8y ago

The passwords in plaintext wasn't a breach or a leak. If you punish Facebook for it, they would be less inclined to share such information in the future.

tkxxx7 8y ago
That's how you handle children, though. No one is going to ignore wrongdoings in hopes the perp will continue to play nicely.
munk-a 8y ago
If we can't trust a company to audit themselves fairly (in fact, we can't generally) then they should bear the burden of paying for an external audit of their processes, many "boring" industries have these sorts of requirements.
jyrkesh 8y ago
There might not have been a large-scale public data dump of passwords, but if 20,000[1] employees had access to logs with plaintext passwords, there is no guarantee I could ever accept that zero of them read or used customer passwords for personal purposes. What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plaintext, they very likely weren't auditing log access as much as was needed. [1] https://www.theverge.com/2019/3/21/18275837/facebook-plain-text-password-storage-hundreds-millions-users https://www.theverge.com/2019/3/21/18275837/facebook-plain-t...
- UncleMeat 8y ago
  Malicious insiders don't need your password to access your data. If you are concerned about malicious insiders then plaintext password logs don't matter.
  - _jal 8y ago
    With FB's dataset and employee count, it would be insane not to be concerned with malicious insiders. Even if you completely discount morality and honesty where Facebook is concerned (and I do), there's substantial liability risk, PR risk, regulatory risk and commercial paranoia, which I suspect was likely their biggest concern, at least until recently.
  - beat 8y ago
    I'm more concerned with plaintext passwords because most people use the same passwords over and over, so if you can break one system, you can break others.

tempestn 8y ago

There's a dead sibling to my comment mentioning that your congruence.io website has an expired SSL certificate, fyi.

stubish 8y ago

There is no oversight in a Devops world. New systems come up in protoduction, celebrations are had, and the data protection officers and security compliance officers remain in blissful ignorance.