4 ms·

I'm all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed so

I'm all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed something deeply personal to them. Just something to keep in mind before automating the sharing of cracked passwords for otherwise legitimate purposes. I consider my passwords my private information, even if they are no longer secure from a technical standpoint and shouldn't be in use. I hope people respect that if they come across them.

sangnoir 7y ago
I wonder if that process was passed by legal first. Not only does it make private (in most user's minds) information public, it also makes it legally discoverable!
- jedberg 7y ago
  Yes, it was passed by legal and everyone else. The first warning was automated and the password wasn't revealed. It was only on the second pass once you had ample warning. But to be fair, I wouldn't do that today. I would just shut off the account on the second pass.
AWildC182 7y ago
Given the frequency of online password db breaches, this seems like a really bad idea...
tom_mellior 7y ago
Agreed. I would hope that the first email was automated and nobody actually looked at the results of cracking the passwords. In the second week, you arguably had less expectation of privacy.
- jedberg 7y ago
  Correct, the first warning was automated and the password was not revealed.
CydeWeys 7y ago
You shouldn't be using deeply personal stuff like this for work passwords then. It's very legitimate for a company to want to protect themselves from a massively damaging and costly security/privacy incident by policing against the use of weak passwords.
- TallGuyShort 7y ago
  Just to be clear, I agree, and I think what the person I'm replying to did is totally kosher. But I just think the fact that my password is private should not just be within technical limitations. If you find my password is "hurtmedaddy" I have a reasonable expectation to privacy about that beyond what SHA can and can't protect me from, and I would hope it's not showing up in some weekly report to be shared with IT. A hacker might find it anyway, but certainly my boss certainly shouldn't have to. edit: And back to technical concerns - someone knowing my password leaves a hard-to-audit window in which I am even less secure. Force-resetting the password in automation instead of revealing it would be better. Sharing it more widely before the problem is fixed increases the risk.
  - kelnos 7y ago
    I personally would not have any expectation that my work passwords are private. I would expect, say, Google to keep my password private, and have internal controls around not letting people see my password, or leak it to the outside. But I'd have no expectation that my boss or IT department didn't have the ability to find out what my password was if they wanted. For strength of security, I really hope they're hashing passwords, but it's well within their rights to try to crack that hash, or log my password as I send it to a webserver the company controls if they want/need to for any reason. As an imperfect analogy, let's say I write something in a plaintext document, a big rant about how I'm pissed off at one of the executives, and in that rant I make a (not serious, but certainly worrisome) threat against the exec. I foolishly decide to store this document in my company-provided storage on their servers. (Or let's say I stick it in Google Docs in the company's GSuite account.) Should I have a reasonable expectation of privacy there? I'd say no. I get that some might have the feeling that passwords are different because their entire function is to be private. From a security perspective, yes, I agree. But form a "what you do on company property/resources is visible to the company if they want it to be" perspective, I don't.
deleted 7y ago
[deleted]

sangnoir 7y ago

I wonder if that process was passed by legal first. Not only does it make private (in most user's minds) information public, it also makes it legally discoverable!

jedberg 7y ago
Yes, it was passed by legal and everyone else. The first warning was automated and the password wasn't revealed. It was only on the second pass once you had ample warning. But to be fair, I wouldn't do that today. I would just shut off the account on the second pass.

AWildC182 7y ago

Given the frequency of online password db breaches, this seems like a really bad idea...

tom_mellior 7y ago

Agreed. I would hope that the first email was automated and nobody actually looked at the results of cracking the passwords. In the second week, you arguably had less expectation of privacy.

jedberg 7y ago
Correct, the first warning was automated and the password was not revealed.

CydeWeys 7y ago

You shouldn't be using deeply personal stuff like this for work passwords then. It's very legitimate for a company to want to protect themselves from a massively damaging and costly security/privacy incident by policing against the use of weak passwords.

TallGuyShort 7y ago
Just to be clear, I agree, and I think what the person I'm replying to did is totally kosher. But I just think the fact that my password is private should not just be within technical limitations. If you find my password is "hurtmedaddy" I have a reasonable expectation to privacy about that beyond what SHA can and can't protect me from, and I would hope it's not showing up in some weekly report to be shared with IT. A hacker might find it anyway, but certainly my boss certainly shouldn't have to. edit: And back to technical concerns - someone knowing my password leaves a hard-to-audit window in which I am even less secure. Force-resetting the password in automation instead of revealing it would be better. Sharing it more widely before the problem is fixed increases the risk.
- kelnos 7y ago
  I personally would not have any expectation that my work passwords are private. I would expect, say, Google to keep my password private, and have internal controls around not letting people see my password, or leak it to the outside. But I'd have no expectation that my boss or IT department didn't have the ability to find out what my password was if they wanted. For strength of security, I really hope they're hashing passwords, but it's well within their rights to try to crack that hash, or log my password as I send it to a webserver the company controls if they want/need to for any reason. As an imperfect analogy, let's say I write something in a plaintext document, a big rant about how I'm pissed off at one of the executives, and in that rant I make a (not serious, but certainly worrisome) threat against the exec. I foolishly decide to store this document in my company-provided storage on their servers. (Or let's say I stick it in Google Docs in the company's GSuite account.) Should I have a reasonable expectation of privacy there? I'd say no. I get that some might have the feeling that passwords are different because their entire function is to be private. From a security perspective, yes, I agree. But form a "what you do on company property/resources is visible to the company if they want it to be" perspective, I don't.

deleted 7y ago

[deleted]