4 ms·

At my last job, I wrote a little tool to download hipchat chat logs and scrape them for anything that looks like a password. There were tons!! I raised it to th

At my last job, I wrote a little tool to download hipchat chat logs and scrape them for anything that looks like a password. There were tons!! I raised it to the CTO/CIO, and while they sounded interested in it, they never enacted any policies, etc, to prevent the sort of password sharing that anyone can apparently easily take advantage of. In fact, the CIO asked me to send him a spreadsheet of when/where passwords were shared -- and then never did anything with it, despite the file essentially being a password map of the infrastructure. When I asked him if he deleted it, he told me he couldn't because the company's lawyers wouldn't allow him to. Lol. It's insane out there.

bmurphy1976 7y ago
The correct answer is routine password rotation, but of course that's stupidly hard to do.
- eeeeeeeeeeeee 7y ago
  I don’t agree with that. Regular password rotation increases the opportunity for phishing attacks because people become used to sleep walking through it. And users are generally just adding one or two characters to the password anyway. Instead, that energy is better spent on requiring strong passwords and people using password managers and two-factor.
  - pmh 7y ago
    Password rotation in this context is for the infrastructure, not normal user accounts. There are other options for securing/managing infrastructure access (e.g. PKI, Hashicorp Vault), but if you're using passwords, it's a good idea to rotate them if only to encourage good practices around automation.
  - bmurphy1976 7y ago
    I'm not referring to user accounts, I'm referring to password management for things such as database and/or internal APIs.
tnorthcutt 7y ago
What did you use for "looks like a password"?
- bpchaps 7y ago
  I use a python library called 'passwordmeter' to check the password 'strength' of tokens. If the token's password strength is high, it's either going to be a password, a hash, a key, or perl (half joking). It's then just a matter of ignoring the false positives - about 95% - but that's not as time consuming as it sounds considering the reward. The precursor to the hipchat scraper: https://github.com/red-bin/password_finder https://github.com/red-bin/password_finder
  - tnorthcutt 7y ago
    Cool, thanks!

bmurphy1976 7y ago

The correct answer is routine password rotation, but of course that's stupidly hard to do.

eeeeeeeeeeeee 7y ago
I don’t agree with that. Regular password rotation increases the opportunity for phishing attacks because people become used to sleep walking through it. And users are generally just adding one or two characters to the password anyway. Instead, that energy is better spent on requiring strong passwords and people using password managers and two-factor.
- pmh 7y ago
  Password rotation in this context is for the infrastructure, not normal user accounts. There are other options for securing/managing infrastructure access (e.g. PKI, Hashicorp Vault), but if you're using passwords, it's a good idea to rotate them if only to encourage good practices around automation.
- bmurphy1976 7y ago
  I'm not referring to user accounts, I'm referring to password management for things such as database and/or internal APIs.

tnorthcutt 7y ago

What did you use for "looks like a password"?

bpchaps 7y ago
I use a python library called 'passwordmeter' to check the password 'strength' of tokens. If the token's password strength is high, it's either going to be a password, a hash, a key, or perl (half joking). It's then just a matter of ignoring the false positives - about 95% - but that's not as time consuming as it sounds considering the reward. The precursor to the hipchat scraper: https://github.com/red-bin/password_finder https://github.com/red-bin/password_finder
- tnorthcutt 7y ago
  Cool, thanks!