7 ms·

I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem

I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it's perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you have an obligation to your users to not be nosy, and if you find out something you shouldn't, keep it under your hat. Just because you have the ability to peek into the CFO's mailbox and see what everyone's salary is, doesn't mean you print out the spreadsheet and take it to your boss demanding a raise. It's kinda like if you got in trouble for playing Farmville or whatever while sitting on the toilet at work, which they found out about by installing cameras in the stalls. Yes, I shouldn't have been doing that, but how you found out is also a huge issue and I'd feel pretty violated. You should probably re-read the sudo warning: We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility.

jedberg 7y ago
I wasn't reading the cracked passwords for fun, I was verifying the output. And it was well known that we cracked the passwords, and he had already gotten the first warning that it was cracked, so he knew we knew it. That's why I didn't feel bad taking it to HR. I already had a sense that he was doing bad stuff, and the password just solidified it for me.
bcit-cst 7y ago
Yeah that is some NSA shit.
- jedberg 7y ago
  Not really. It was well known that passwords were being cracked, and the guy in question was even warned already that his password had been cracked the week before.
  - program_whiz 7y ago
    Wait, how is it a common / weak password if it has some oddly sexual phrase regarding a specific person? Sounds like its literally just brute-forcing, in which case you're just going to hit random user's passwords.
    - jedberg 7y ago
      A string of dictionary words and a very common name. And yeah, JohnTheRipper was a brute forcing dictionary attack that was very common. If anyone had access to the password file they could run the same cracker. The idea was to crack the passwords before an advisary could using the same tools.
      - 1000units 7y ago
        Next time you can push for explicit password quality requirements and something like 2FA instead of violating people's privacy and weakening their security at the same time. (Can you imagine anyone reused personal passwords?) This eagerness to apply fun tools in the workplace is in large part what built the heinous surveillance apparatus that's probably going to kill a lot of people as soon as a sufficiently strong-willed fascist takes control again. Richard Stallman has called this "Stalin's dream", but ironically he was also recently Cancelled for ridiculous allegations of sexual misconduct and wrong-think, so perhaps this allusion is not sufficiently powerful for this audience anymore. A shame if so.
  - 1000units 7y ago
    Much "NSA shit" is also well known. The questionable behavior in this case is getting a guy fired for selecting a politically-incorrect secret passphrase. This is merely one step removed from reading his brain and figuring out he fantasizes about spanking coworkers while having sex with them. (I've done this, and yet we are good friends!) We don't know all the details, maybe that guy actually harassed people, but scrutinizing someone's private thoughts without prior suspicion for offensive-but-noncriminal behavior that can be pivoted into larger accusations is how police states work. In the best case, this encourages people to filter their private thoughts and actions by the standards of what is acceptable to advertise publicly, which is incredibly unhealthy and oppressive.
brosinante 7y ago
Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.
- Quekid5 7y ago
  You know, it's quite possible for multiple people to be "wrong" in a given situation. It's possible both the employee and the sysop to be wrong.
  - yaseer 7y ago
    I agree, - but morality is sticky and complex. It was obviously wrong to be the creepy sexist. In the abstract sense, it is wrong to invade privacy. But then, if in your invasion of privacy you uncover a wrongdoing, the right thing to do is report it. It would be wrong to read the CFO's email inbox, and probably illegal. But then if you uncover they are committing fraud, you need to report it to police, as well as confess your own crime. Unfortunately, there's never easy rules for these things.
    - WBrad 7y ago
      I get what you're saying here but: >In the abstract sense, it is wrong to invade privacy. You have no real expectation of privacy when using company owned equipment. This was almost certainly spelled out to the employee in question in the acceptable use policy he agreed to upon being hired. Companies have to operate this way so they can investigate computers if compelled to by court or law, and so they can recover important information off computers when the user exits the company. If he was using a BYOD computer I'd have a different opinion on the matter.
      - yaseer 7y ago
        You make a compelling point. The key is 'acceptable use'. Acceptable use is cracking passwords in an investigation with just cause. Acceptable use is a script to automate the checking of weak passwords, and notify users. Unacceptable use is an admin browsing cracked passwords, without just cause. I personally think acting on the information obtained afterwards is acceptable, but some would disagree. Remember even in some courts, evidence obtained by police illegally cannot be submitted for trial. I maintain these moral problems are hard ones.
kelnos 7y ago
I think this is analogous to the philosophy behind "duty to report" type laws. If you discover -- even through a completely unrelated activity -- harm being done to someone, it is your ethical responsibility to report it to someone who can help. Obviously some amount of discretion is necessary, as some things are sensitive enough that reporting in the wrong way, or to the wrong person, could cause the situation to be worse, but as a general rule, if you see something bad going on, you should try to make the situation better if you're able. I think OP acted entirely appropriately. To address a couple specific points: > As an admin you have an obligation to your users to not be nosy In the free-wheeling academic sense where your users are more of a community, sure, I think that's the accepted social contract. In the workplace, not at all. While I'm not a fan of employers spying on what their employees do on the employer's network and hardware, I fully appreciate that it is their right to do so, and in some situations, for some purposes, I might even agree with its necessity. > reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do I don't think "fun" had anything to do with it, and reporting a likely case of sexual harassment, regardless of how the information was obtained, is never "slimy". Quite the opposite. > Just because you have the ability to peek into the CFO's mailbox and see what everyone's salary is, doesn't mean you print out the spreadsheet and take it to your boss demanding a raise. That is indeed slimy, unethical, and likely a violation of company policy, but that is not even remotely the same as what the OP did. > if you got in trouble for playing Farmville or whatever while sitting on the toilet at work, which they found out about by installing cameras in the stalls Also not even remotely the same. Any reasonable person would agree that cameras in bathroom stalls would be a gross violation of privacy (and probably illegal).
crtlaltdel 7y ago
and to think of all the times i used passwords that were a some variation of “thisCompanySucks@$$!” or “B1llis@d!ck”...
adrianmonk 7y ago
Former sysadmin here. I think there's a careful balance that needs to be struck, both by admins and users. As a user, you should realize that when you're on company equipment, privacy is more of a courtesy than a right. It's their equipment you're using. It's reasonable to expect them to use it in a way that furthers the company's interests. So act accordingly. As an admin, you don't ever go digging through stuff for no reason, for curiosity, voyeurism, or for personal reasons. But again, watching out for the company's interests is part of your job, so if you run across something or have a concrete need to actively look for something (not just a fishing expedition), then lifting the veil of privacy might be the right choice or even the only right choice. Basically, in a corporate computing environment, privacy is not guaranteed, but crossing lines should have a proper justification. In your CFO example, the sysadmin is using official powers but acting in their own interest, so that's definitely not an OK justification.
- feanaro 7y ago
  > It's their equipment you're using. I don't find this a very good argument. Sourcing inspiration from a sibling comment, it's also the employer's bathroom stall. I might be convinced it's okay to snoop when it comes to their network usage, but this is not the argument to do so.
  - adrianmonk 7y ago
    Responding late, but yeah, you raise a valid point. The difference to me is in the purpose of the two facilities. A toilet is there for the employees' physical needs and more or less no other purpose. A computer is there primarily to do business work on. The company has a clear need to be involved in how that computer is used in several ways, such as maintaining its security, monitoring its performance, making sure it isn't misused, etc. They can afford you some privacy, but only on a best-effort basis because it's not reasonable to be entirely hands off.
wil421 7y ago
How is that slimy? You have no expectation of privacy at work. The company owns everything. They not only own it but they monitor everything that’s done on their devices. If you don’t want something read by your employer don’t do it with company property or on their WiFi. It’s a rule I live by and I never connect any personal device to my company’s guest WiFi.

jedberg 7y ago

I wasn't reading the cracked passwords for fun, I was verifying the output. And it was well known that we cracked the passwords, and he had already gotten the first warning that it was cracked, so he knew we knew it. That's why I didn't feel bad taking it to HR. I already had a sense that he was doing bad stuff, and the password just solidified it for me.

bcit-cst 7y ago

Yeah that is some NSA shit.

jedberg 7y ago
Not really. It was well known that passwords were being cracked, and the guy in question was even warned already that his password had been cracked the week before.
- program_whiz 7y ago
  Wait, how is it a common / weak password if it has some oddly sexual phrase regarding a specific person? Sounds like its literally just brute-forcing, in which case you're just going to hit random user's passwords.
  - jedberg 7y ago
    A string of dictionary words and a very common name. And yeah, JohnTheRipper was a brute forcing dictionary attack that was very common. If anyone had access to the password file they could run the same cracker. The idea was to crack the passwords before an advisary could using the same tools.
    - 1000units 7y ago
      Next time you can push for explicit password quality requirements and something like 2FA instead of violating people's privacy and weakening their security at the same time. (Can you imagine anyone reused personal passwords?) This eagerness to apply fun tools in the workplace is in large part what built the heinous surveillance apparatus that's probably going to kill a lot of people as soon as a sufficiently strong-willed fascist takes control again. Richard Stallman has called this "Stalin's dream", but ironically he was also recently Cancelled for ridiculous allegations of sexual misconduct and wrong-think, so perhaps this allusion is not sufficiently powerful for this audience anymore. A shame if so.
- 1000units 7y ago
  Much "NSA shit" is also well known. The questionable behavior in this case is getting a guy fired for selecting a politically-incorrect secret passphrase. This is merely one step removed from reading his brain and figuring out he fantasizes about spanking coworkers while having sex with them. (I've done this, and yet we are good friends!) We don't know all the details, maybe that guy actually harassed people, but scrutinizing someone's private thoughts without prior suspicion for offensive-but-noncriminal behavior that can be pivoted into larger accusations is how police states work. In the best case, this encourages people to filter their private thoughts and actions by the standards of what is acceptable to advertise publicly, which is incredibly unhealthy and oppressive.

brosinante 7y ago

Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.

Quekid5 7y ago
You know, it's quite possible for multiple people to be "wrong" in a given situation. It's possible both the employee and the sysop to be wrong.
- yaseer 7y ago
  I agree, - but morality is sticky and complex. It was obviously wrong to be the creepy sexist. In the abstract sense, it is wrong to invade privacy. But then, if in your invasion of privacy you uncover a wrongdoing, the right thing to do is report it. It would be wrong to read the CFO's email inbox, and probably illegal. But then if you uncover they are committing fraud, you need to report it to police, as well as confess your own crime. Unfortunately, there's never easy rules for these things.
  - WBrad 7y ago
    I get what you're saying here but: >In the abstract sense, it is wrong to invade privacy. You have no real expectation of privacy when using company owned equipment. This was almost certainly spelled out to the employee in question in the acceptable use policy he agreed to upon being hired. Companies have to operate this way so they can investigate computers if compelled to by court or law, and so they can recover important information off computers when the user exits the company. If he was using a BYOD computer I'd have a different opinion on the matter.
    - yaseer 7y ago
      You make a compelling point. The key is 'acceptable use'. Acceptable use is cracking passwords in an investigation with just cause. Acceptable use is a script to automate the checking of weak passwords, and notify users. Unacceptable use is an admin browsing cracked passwords, without just cause. I personally think acting on the information obtained afterwards is acceptable, but some would disagree. Remember even in some courts, evidence obtained by police illegally cannot be submitted for trial. I maintain these moral problems are hard ones.

kelnos 7y ago

I think this is analogous to the philosophy behind "duty to report" type laws. If you discover -- even through a completely unrelated activity -- harm being done to someone, it is your ethical responsibility to report it to someone who can help. Obviously some amount of discretion is necessary, as some things are sensitive enough that reporting in the wrong way, or to the wrong person, could cause the situation to be worse, but as a general rule, if you see something bad going on, you should try to make the situation better if you're able. I think OP acted entirely appropriately. To address a couple specific points: > As an admin you have an obligation to your users to not be nosy In the free-wheeling academic sense where your users are more of a community, sure, I think that's the accepted social contract. In the workplace, not at all. While I'm not a fan of employers spying on what their employees do on the employer's network and hardware, I fully appreciate that it is their right to do so, and in some situations, for some purposes, I might even agree with its necessity. > reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do I don't think "fun" had anything to do with it, and reporting a likely case of sexual harassment, regardless of how the information was obtained, is never "slimy". Quite the opposite. > Just because you have the ability to peek into the CFO's mailbox and see what everyone's salary is, doesn't mean you print out the spreadsheet and take it to your boss demanding a raise. That is indeed slimy, unethical, and likely a violation of company policy, but that is not even remotely the same as what the OP did. > if you got in trouble for playing Farmville or whatever while sitting on the toilet at work, which they found out about by installing cameras in the stalls Also not even remotely the same. Any reasonable person would agree that cameras in bathroom stalls would be a gross violation of privacy (and probably illegal).

crtlaltdel 7y ago

and to think of all the times i used passwords that were a some variation of “thisCompanySucks@$$!” or “B1llis@d!ck”...

adrianmonk 7y ago

Former sysadmin here. I think there's a careful balance that needs to be struck, both by admins and users. As a user, you should realize that when you're on company equipment, privacy is more of a courtesy than a right. It's their equipment you're using. It's reasonable to expect them to use it in a way that furthers the company's interests. So act accordingly. As an admin, you don't ever go digging through stuff for no reason, for curiosity, voyeurism, or for personal reasons. But again, watching out for the company's interests is part of your job, so if you run across something or have a concrete need to actively look for something (not just a fishing expedition), then lifting the veil of privacy might be the right choice or even the only right choice. Basically, in a corporate computing environment, privacy is not guaranteed, but crossing lines should have a proper justification. In your CFO example, the sysadmin is using official powers but acting in their own interest, so that's definitely not an OK justification.

feanaro 7y ago
> It's their equipment you're using. I don't find this a very good argument. Sourcing inspiration from a sibling comment, it's also the employer's bathroom stall. I might be convinced it's okay to snoop when it comes to their network usage, but this is not the argument to do so.
- adrianmonk 7y ago
  Responding late, but yeah, you raise a valid point. The difference to me is in the purpose of the two facilities. A toilet is there for the employees' physical needs and more or less no other purpose. A computer is there primarily to do business work on. The company has a clear need to be involved in how that computer is used in several ways, such as maintaining its security, monitoring its performance, making sure it isn't misused, etc. They can afford you some privacy, but only on a best-effort basis because it's not reasonable to be entirely hands off.

wil421 7y ago

How is that slimy? You have no expectation of privacy at work. The company owns everything. They not only own it but they monitor everything that’s done on their devices. If you don’t want something read by your employer don’t do it with company property or on their WiFi. It’s a rule I live by and I never connect any personal device to my company’s guest WiFi.