10 ms·

> "They violated our password policies and they posted that password on an internal, on their own private Github account," Thompson said. So let's analyze the

> "They violated our password policies and they posted that password on an internal, on their own private Github account," Thompson said. So let's analyze the various scenarios under which the "intern" might have been responsible, and why each one is bullshit. 1) The intern exposed a company password on their own account. Counter: What kind of "password policies" allowed such a weak password in the first place? 2) The intern came up with the weak password themselves, thus violating "password policies" not just for secrecy but strength/security. This password was then used for several critical, production applications. Counter: Why was an intern in charge of deciding a password used for anything critical? 3) The intern came up with the weak password and exposed it, but it was only used for the intern's own corporate accounts (e.g. their Windows workstation). Counter: Why did an intern have a level of access such that their account being breached could lead to this level of compromise/exfiltration? Conclusion: There is no conceivable scenario under which this makes sense.

deleted 6y ago
[deleted]
laurent92 6y ago
Worst scenario: The intern is malevolent. Counter: Credentials should be given progressively as trust is built (and as lessons are learnt), and an intern can’t have access to production. I have an employee who I thought I could give more responsibilities, but he keeps not locking his computer when he walks away. He has very limited access to everything and it would impede his career if he didn’t also have the same attitude about other issues. (My question is, how do I make him diligent — It’s real potential wasted).
- ethanwillis 6y ago
  Have you explained this to him?
  - marcus_holmes 6y ago
    Further, have you really listened to his explanation of why he isn't bothered about locking his computer? It might be that in your organisation this is a cargo-cult security practice that he's not bothered by because he knows it's not an effective practice. Or it could be that he knows he doesn't have enough permissions to do any damage, so he doesn't bother locking his computer. Trusting him with a little responsibility might change that.
- monkeybutton 6y ago
  This isn't a solution you can implement yourself since it sounds like you're in a position of power over the employee and it would be harassment. But having a culture where leaving computers unlocked and unattended is an open invitation to getting embarrassing YouTube videos opened on full screen by your peers works wonders for getting people to lock their computers. I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work.
  - Judgmentality 6y ago
    > I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work. Oof, this hits close to home. I don't have an answer either.
  - throwawayboise 6y ago
    How on earth is it harrassment to tell a subordinate that he needs to improve his security habits?
    - monkeybutton 6y ago
      The harassment would be the doing embarrassing things with the unlocked computer. A manager or team lead shouldn't be picking on their employees like that. It's something more OK for a peer to do. Ironically, it's the interns who I've seen get into it the most and make it a game. They really got a kick out catching the full timers.
      - NeutronStar 6y ago
        Harassment has to be a repeated and unwanted action against someone. If it's one time, it's not harassment. If you don't speak up against the perceived harassment, can it even be considered harassment? Also would you rather be fired instead? There's real life implications to not locking his computer.
      - 6y ago
- eat_veggies 6y ago
  At a company I used to work for, if someone left their computer unlocked, we'd send the donut emoji into the #everyone channel on slack from their computer, and they'd have to buy donuts for the office
  - monkeybutton 6y ago
    This too but with croissants. It even became a verb. To croissant someone or be croissant-ed! Edit: Also singing over the top praises of employees using the victim's account. "MonkeyButton is truly the best coworker I have ever had " All this fun has gone away now with Covid and remote working.
    - Kyro38 6y ago
      You're french right ?
  - foobiekr 6y ago
    For us, it’s teapots. Inspired by the info set who noted his cube mate couldn’t learn to lock his screen and started sending, from his open laptop, “I’m a little teapot...” first to just him and then the wider org when he failed to adjust his behavior.
  - vvanders 6y ago
    Oh! Story time! We had a similar thing at one gamedev place that I worked at where and email would go out to the team if you left your computer unlocked(I forget the exact phrase but it was fairly silly). We had shared offices and one of the programmers had the office right next to the kitchen. One day we all heard the senior programmer shout "WHAT THE FUCK!" and all ran over to see what had happened. It turns out one of our engineers had walked into the kitchen and left his computer unlocked. The senior developer seeing this had opened up outlook, started a new message and began typing in the subject. What he didn't know is the developer had hand-rolled a keylogger with a match pattern for the message that everyone would send and dispatched Windows+L via key injection to the main window loop. The trap was sprung and the machine locked right in front of him as he typed the last letter unable to send the email. There was all sorts of other shenanigans at that place(like a fake "April 2nd" firing, they got the person who did that back with an annoy-a-tron over a 6 month period) but that was one of the more memorable ones.
- contravariant 6y ago
  Well I've heard of one office that had an established rule that any unlocked laptop could be used to promise the rest of the team free cake on behalf of the person that forgot to lock their laptop. If nothing else at least it promotes awareness (and cake!).
- akiselev 6y ago
  Why is locking your computer at work a security concern? It's certainly another layer in the onion but a rather weak one and certainly not one worth losing someone over. If it's so big an issue, get him a smart watch that works with their OS of choice and enforce a bluetooth device locking policy. Physical access is considered game over, no?
  - coffeefirst 6y ago
    Right. There are some intense security environments where they also deal in airgaps and the like, but this is insane behavior at a regular job.
  - camjohnson26 6y ago
    I agree, I’m sure it helps but seems like if a malicious coworker wants access they can trivially steal your password with a keylogger or just watching you type it in. May prevent spontaneous acts I guess but feels like if those are really a risk you’ve hired the wrong people.
  - josh3736 6y ago
    It's actually a legitimate concern, and it goes far beyond coworkers embarrassing you in slack. For example, posted yesterday: https://tailscale.com/blog/rotate-ssh-keys/ https://tailscale.com/blog/rotate-ssh-keys/ (https://news.ycombinator.com/item?id=26249380 https://news.ycombinator.com/item?id=26249380) > One company had an employee they fired for bad behaviour. A few months later all their production servers got wiped out. ... A month later, it happened again! Everything gone. > What happened was that the rogue employee, months before they were fired, had waited until everyone went to lunch, walked around from one PC to the next, and collected the ssh private keys from any of them that weren’t locked. ... Then, a while after getting fired, he used a co-worker’s ssh key to login and destroy everything. Of course, screen locking would not prevent a determined, disgruntled (or desperate) employee from pulling off something like this, but it would stop the casual collection of secrets while everyone is at lunch. Add full disk encryption to PCs and you have a reasonable chance at defending. Oh, and if you're doing anything with credit cards, PCI DSS requires you to enforce a workstation locking policy. Failing to do so opens you up to massive liability in the event of a breach.
- kordlessagain 6y ago
  It's too bad you are on here disparaging a current employee.
- staysaasy 6y ago
  I strongly recommend just sitting him or her down and explaining why this is a problem (you've articulated it well here). Either they get more diligent (great) they can't get more diligent (not great) or they refuse to be more diligent (really not great). I think that there's sometimes a tendency to overthink management topics - there's no need to overthink this one.
- ukj 6y ago
  2-factor authentication allows you to bias yourself towards suspecting malevolence. It's reasonably believable that they leaked their password because. Interns. And the second factor?
Ekaros 6y ago
Also what is the password rotation policy if this password was valid for years and intern had access to it? Reasonably I would expect all of the shared passwords to be rotated every time some person leaves.
- x0x0 6y ago
  It's the wrong question; it's incompetent to even use passwords. SAML all the things, and protect your IdP with yubikeys.
toss1 6y ago
If Solar Winds CEO, CTO, and everyon below them had taken the responsibility of security even slightly seriously, they would have made the system secure against such leaks. Some really simple steps: 1) access restrictions such that even malicious interns, and certainly careless interns can do little damage *when* the inevitable leak happens 2) Actively scan everyone's online presence, and let them know that this is a requirement of employment. 3) Require 2FA 4) Much better training so it is reduced 5) Internally firewalled and airgapped systems I could go on... but none of these were done The fact that they blame the intern shows that they are insanely unqualified for any job related to any sort of security. These CxOs are active hazards in the industry.
- kazen44 6y ago
  > 1) access restrictions such that even malicious interns, and certainly careless interns can do little damage when the inevitable leak happens this should be something that is implemented in any organisation beyond a very small scale, mainly because even if not malicious, people should not be able to make critical mistakes in systems they have no know how off. The intern leaked the password, but how was he able to know this was critical information? Not to mention he should never have been put in that position in the first place.
mynameisash 6y ago
Years ago, not long after I started at Amazon, there was a huge Netflix outage[0]. It surfaced - or at least was widely speculated - that the cause was a pretty green employee running a DROP TABLE command against a prod database instead of a dev environment. One morning when I came in and sat down at my desk, all of the old-timers were having coffee and discussing the fiasco. I was very happy to hear all of them talk about how mistakes happen, and the last person to be blamed for such an outage is the poor guy or gal that hit the ENTER button. Rather, blame falls (to various degrees) on: the engineers in their orbit who should be backing them up; the managers helping to onboard them; the chain of command; the entire system that is in place to prevent inappropriate access. One of my best early-in-career lessons was that it takes maturity to own up to your mistakes (no matter how bone-headed), and it also takes good managers and a good company to foster an environment in which you can own up to them without fear of losing your job. Any company that wants to hang a weight around an intern's neck for something like this is not a company I would want to support in any way. [0] https://netflixtechblog.com/a-closer-look-at-the-christmas-eve-outage-d7b409a529ee https://netflixtechblog.com/a-closer-look-at-the-christmas-e...
- kazen44 6y ago
  > One of my best early-in-career lessons was that it takes maturity to own up to your mistakes (no matter how bone-headed), and it also takes good managers and a good company to foster an environment in which you can own up to them without fear of losing your job. Any company that wants to hang a weight around an intern's neck for something like this is not a company I would want to support in any way. owning up to your mistakes also gives you an incredible amount of credibility and respect in my opinion. Mistakes happen, especially in complex systems. Owning up to mistakes and explaining your reasoning about your actions makes you and your compatriots better engineers. Excluding malicious action, most people make a (semi) critical error sometime in their career, especially if you work on the ops side of things, these can often be disasterous. Engineering who claim they never have made a mistake that usually either not working on anything that has value or are just lucky in my opinion. engineering who are afraid to say they made a mistake are a cultural issue aswell, because it delays troubleshooting during incidents. Something we tell employees during our onboarding in a technical comes down to this. - reason about a problem by yourself first - think about impact before you do a change, if in doubt, ask and doublecheck. - admit mistakes when you realise them, explain your reasoning and why you did the action. - learn from your mistakes, but accept that being error-free is simply not possible.
aklemm 6y ago
Absolutely right, and further, we in tech know better as we could walk into so many big name shops and not be surprised to find huge, simple, obvious security holes. We know it’s standard operating procedure too often, so this blaming an intern rings hollow.
hnlmorg 6y ago
Agreed. All this statement does is reinforce the speculation that there was a failure of process but adds to that that there is a culture of blame rather than a culture of improvement. If a mistake happens, don't blame the individual, blame the process then find a way to fix that process. If a company has a blame culture people spend more time covering their own arse instead of building safer processes.
- jrumbut 6y ago
  This is such an extreme example of a culture of blame, testifying to Congress that an intern did it 3 years ago?
itsdrewmiller 6y ago
They said in the article they don't know if this password was even related to the breach (meaning all of these points are not really describing reality, especially #3). It's not very clear what the password was for from the article. Sounds like the CEO doesn't have a very good understanding of what Github is though unless this intern was POCing github enterprise or something though.
- camjohnson26 6y ago
  How could this password even be “leaked”, it’s so trivial that it would be on a list of first 10 passwords you would guess.
coding123 6y ago
4) What was the user name? A password should be no good without a user name.
austincheney 6y ago
The same is true of passwords now since the invention of rainbow tables. The best way, aside from voluntary disclosure, to compromise any password is brute force. The best way to eliminate brute force is to require a long minimum character count and to hash passwords using a 512bit hash algorithm. Imagine the size of a rainbow table of SHA512 or SHA3-512 hashes for a 60 character password. A 60 character password could be as simple as: * I enjoy driving my tiny white car with a standard transmission. * My big cat, Ace, really sleeps a lot during the day while I work! * Growing up my favorite song was Time by Pink Floyd about regret :(
- GordonS 6y ago
  For most passwords, you should be using a password manager, which means long, high entropy passwords (which will not be memorable as a result). For the few that you need to manually enter, something long is good, but it should ideally use characters or different classes, and ideally not be comprised solely of dictionary words (which your first example is), otherwise the search space is greatly reduced. Also, manually entering a 60 character password is not going to be fun :) I think the longest "manual enter" password I have is 25 characters, and it's a PITA to enter in a password field!
  - austincheney 6y ago
    > high entropy passwords You only need that to impose a greater character width against brute force attacks. That is the only value in high entropy. The actual reason people think they need this is because it was written into a NIST publication a very long time ago and it just became common practice. As a proof of concept what is the published standard that imposes that practice? I bet you think you need this but cannot find the written standard guidance suggesting it. The guy who originally wrote that standard later came out and said it was a mistake. Bad advise that he wishes he could take back, but it’s too late everybody thinks they need it and they don’t know why or where that guidance even comes from. > and it's a PITA to enter in a password field! Only on a touch screen. My first example also contains uppercase and punctuation. Think of it like IPv6. When the key space is large enough you don’t need a bunch of bullshit and gimmicks to ensure uniqueness.
mojomark 6y ago
> > So let's analyze the various scenarios under which the "intern" might have been responsible, and why each one is bullshit. "you can delegate authority, but you cannot delegate responsibility." [1] This CEO is a very poor leader. 1. https://www.theleadermaker.com/you-cant-delegate-responsibility/ https://www.theleadermaker.com/you-cant-delegate-responsibil...
toast0 6y ago
> Counter: Why did an intern have a level of access such that their account being breached could lead to this level of compromise/exfiltration? I've worker with interns whose major redeeming quality was that their internship was fixed length and would be over soon. I've also worker with interns who demonstrated ability and responsibility sufficient to get the same access that I had (and, clearly, an offer letter). That it was an intern doesn't mean the level of access was inappropriate; of course, if it were my intern, I would take blame for them leaving their password on github.
- saagarjha 6y ago
  Is it not usual for an intern to get access to the repository and production databases like a new employee would?
  - alisonkisk 6y ago
    It shouldn't be usual. Temps don't get unsupervised access to sensitive systems. Too much risk of abuse and misuse from short-term less mature employees.
ukj 6y ago
2-factor authentication would've mitigated any one of the above failure points.
tinus_hn 6y ago
In many companies any account password is critical, because any account allows access to the company network and internal security is weak.
lawnchair_larry 6y ago
Are you a college student? Or an independent contractor? I don’t know how anyone who has worked in the real world can have these misconceptions. 1) Every password policy allows for dumb passwords in certain places. Because password policies are only enforced on systems that integrate with the password policy enforcement mechanism. Which never covers everything. Even with a password policy, it’s easy to make dumb passwords. 2) It doesn’t say that the intern chose this policy or that it belonged to something critical. There has been no link established between that password and the breach. A random researcher said they found the password a year ago and reported it. It could have been used, but there’s no reason to believe it’s relevant. 3) Nothing suggests that they did. Conclusion: It’s better to not be an armchair quarterback after a breach, especially when it’s still under active investigation by actual professionals with access to actual data, and they aren’t even making the claims that folks here are making.
bawolff 6y ago
If the entire security of the company rests on every intern being fully competent, that's the higher ups fault.

deleted 6y ago

[deleted]

laurent92 6y ago

Worst scenario: The intern is malevolent. Counter: Credentials should be given progressively as trust is built (and as lessons are learnt), and an intern can’t have access to production. I have an employee who I thought I could give more responsibilities, but he keeps not locking his computer when he walks away. He has very limited access to everything and it would impede his career if he didn’t also have the same attitude about other issues. (My question is, how do I make him diligent — It’s real potential wasted).

ethanwillis 6y ago
Have you explained this to him?
- marcus_holmes 6y ago
  Further, have you really listened to his explanation of why he isn't bothered about locking his computer? It might be that in your organisation this is a cargo-cult security practice that he's not bothered by because he knows it's not an effective practice. Or it could be that he knows he doesn't have enough permissions to do any damage, so he doesn't bother locking his computer. Trusting him with a little responsibility might change that.
monkeybutton 6y ago
This isn't a solution you can implement yourself since it sounds like you're in a position of power over the employee and it would be harassment. But having a culture where leaving computers unlocked and unattended is an open invitation to getting embarrassing YouTube videos opened on full screen by your peers works wonders for getting people to lock their computers. I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work.
- Judgmentality 6y ago
  > I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work. Oof, this hits close to home. I don't have an answer either.
- throwawayboise 6y ago
  How on earth is it harrassment to tell a subordinate that he needs to improve his security habits?
  - monkeybutton 6y ago
    The harassment would be the doing embarrassing things with the unlocked computer. A manager or team lead shouldn't be picking on their employees like that. It's something more OK for a peer to do. Ironically, it's the interns who I've seen get into it the most and make it a game. They really got a kick out catching the full timers.
    - NeutronStar 6y ago
      Harassment has to be a repeated and unwanted action against someone. If it's one time, it's not harassment. If you don't speak up against the perceived harassment, can it even be considered harassment? Also would you rather be fired instead? There's real life implications to not locking his computer.
    - 6y ago
eat_veggies 6y ago
At a company I used to work for, if someone left their computer unlocked, we'd send the donut emoji into the #everyone channel on slack from their computer, and they'd have to buy donuts for the office
- monkeybutton 6y ago
  This too but with croissants. It even became a verb. To croissant someone or be croissant-ed! Edit: Also singing over the top praises of employees using the victim's account. "MonkeyButton is truly the best coworker I have ever had " All this fun has gone away now with Covid and remote working.
  - Kyro38 6y ago
    You're french right ?
- foobiekr 6y ago
  For us, it’s teapots. Inspired by the info set who noted his cube mate couldn’t learn to lock his screen and started sending, from his open laptop, “I’m a little teapot...” first to just him and then the wider org when he failed to adjust his behavior.
- vvanders 6y ago
  Oh! Story time! We had a similar thing at one gamedev place that I worked at where and email would go out to the team if you left your computer unlocked(I forget the exact phrase but it was fairly silly). We had shared offices and one of the programmers had the office right next to the kitchen. One day we all heard the senior programmer shout "WHAT THE FUCK!" and all ran over to see what had happened. It turns out one of our engineers had walked into the kitchen and left his computer unlocked. The senior developer seeing this had opened up outlook, started a new message and began typing in the subject. What he didn't know is the developer had hand-rolled a keylogger with a match pattern for the message that everyone would send and dispatched Windows+L via key injection to the main window loop. The trap was sprung and the machine locked right in front of him as he typed the last letter unable to send the email. There was all sorts of other shenanigans at that place(like a fake "April 2nd" firing, they got the person who did that back with an annoy-a-tron over a 6 month period) but that was one of the more memorable ones.
contravariant 6y ago
Well I've heard of one office that had an established rule that any unlocked laptop could be used to promise the rest of the team free cake on behalf of the person that forgot to lock their laptop. If nothing else at least it promotes awareness (and cake!).
akiselev 6y ago
Why is locking your computer at work a security concern? It's certainly another layer in the onion but a rather weak one and certainly not one worth losing someone over. If it's so big an issue, get him a smart watch that works with their OS of choice and enforce a bluetooth device locking policy. Physical access is considered game over, no?
- coffeefirst 6y ago
  Right. There are some intense security environments where they also deal in airgaps and the like, but this is insane behavior at a regular job.
- camjohnson26 6y ago
  I agree, I’m sure it helps but seems like if a malicious coworker wants access they can trivially steal your password with a keylogger or just watching you type it in. May prevent spontaneous acts I guess but feels like if those are really a risk you’ve hired the wrong people.
- josh3736 6y ago
  It's actually a legitimate concern, and it goes far beyond coworkers embarrassing you in slack. For example, posted yesterday: https://tailscale.com/blog/rotate-ssh-keys/ https://tailscale.com/blog/rotate-ssh-keys/ (https://news.ycombinator.com/item?id=26249380 https://news.ycombinator.com/item?id=26249380) > One company had an employee they fired for bad behaviour. A few months later all their production servers got wiped out. ... A month later, it happened again! Everything gone. > What happened was that the rogue employee, months before they were fired, had waited until everyone went to lunch, walked around from one PC to the next, and collected the ssh private keys from any of them that weren’t locked. ... Then, a while after getting fired, he used a co-worker’s ssh key to login and destroy everything. Of course, screen locking would not prevent a determined, disgruntled (or desperate) employee from pulling off something like this, but it would stop the casual collection of secrets while everyone is at lunch. Add full disk encryption to PCs and you have a reasonable chance at defending. Oh, and if you're doing anything with credit cards, PCI DSS requires you to enforce a workstation locking policy. Failing to do so opens you up to massive liability in the event of a breach.
kordlessagain 6y ago
It's too bad you are on here disparaging a current employee.
staysaasy 6y ago
I strongly recommend just sitting him or her down and explaining why this is a problem (you've articulated it well here). Either they get more diligent (great) they can't get more diligent (not great) or they refuse to be more diligent (really not great). I think that there's sometimes a tendency to overthink management topics - there's no need to overthink this one.
ukj 6y ago
2-factor authentication allows you to bias yourself towards suspecting malevolence. It's reasonably believable that they leaked their password because. Interns. And the second factor?

Ekaros 6y ago

Also what is the password rotation policy if this password was valid for years and intern had access to it? Reasonably I would expect all of the shared passwords to be rotated every time some person leaves.

x0x0 6y ago
It's the wrong question; it's incompetent to even use passwords. SAML all the things, and protect your IdP with yubikeys.

toss1 6y ago

If Solar Winds CEO, CTO, and everyon below them had taken the responsibility of security even slightly seriously, they would have made the system secure against such leaks. Some really simple steps: 1) access restrictions such that even malicious interns, and certainly careless interns can do little damage *when* the inevitable leak happens 2) Actively scan everyone's online presence, and let them know that this is a requirement of employment. 3) Require 2FA 4) Much better training so it is reduced 5) Internally firewalled and airgapped systems I could go on... but none of these were done The fact that they blame the intern shows that they are insanely unqualified for any job related to any sort of security. These CxOs are active hazards in the industry.

kazen44 6y ago
> 1) access restrictions such that even malicious interns, and certainly careless interns can do little damage when the inevitable leak happens this should be something that is implemented in any organisation beyond a very small scale, mainly because even if not malicious, people should not be able to make critical mistakes in systems they have no know how off. The intern leaked the password, but how was he able to know this was critical information? Not to mention he should never have been put in that position in the first place.

mynameisash 6y ago

Years ago, not long after I started at Amazon, there was a huge Netflix outage[0]. It surfaced - or at least was widely speculated - that the cause was a pretty green employee running a DROP TABLE command against a prod database instead of a dev environment. One morning when I came in and sat down at my desk, all of the old-timers were having coffee and discussing the fiasco. I was very happy to hear all of them talk about how mistakes happen, and the last person to be blamed for such an outage is the poor guy or gal that hit the ENTER button. Rather, blame falls (to various degrees) on: the engineers in their orbit who should be backing them up; the managers helping to onboard them; the chain of command; the entire system that is in place to prevent inappropriate access. One of my best early-in-career lessons was that it takes maturity to own up to your mistakes (no matter how bone-headed), and it also takes good managers and a good company to foster an environment in which you can own up to them without fear of losing your job. Any company that wants to hang a weight around an intern's neck for something like this is not a company I would want to support in any way. [0] https://netflixtechblog.com/a-closer-look-at-the-christmas-eve-outage-d7b409a529ee https://netflixtechblog.com/a-closer-look-at-the-christmas-e...

kazen44 6y ago
> One of my best early-in-career lessons was that it takes maturity to own up to your mistakes (no matter how bone-headed), and it also takes good managers and a good company to foster an environment in which you can own up to them without fear of losing your job. Any company that wants to hang a weight around an intern's neck for something like this is not a company I would want to support in any way. owning up to your mistakes also gives you an incredible amount of credibility and respect in my opinion. Mistakes happen, especially in complex systems. Owning up to mistakes and explaining your reasoning about your actions makes you and your compatriots better engineers. Excluding malicious action, most people make a (semi) critical error sometime in their career, especially if you work on the ops side of things, these can often be disasterous. Engineering who claim they never have made a mistake that usually either not working on anything that has value or are just lucky in my opinion. engineering who are afraid to say they made a mistake are a cultural issue aswell, because it delays troubleshooting during incidents. Something we tell employees during our onboarding in a technical comes down to this. - reason about a problem by yourself first - think about impact before you do a change, if in doubt, ask and doublecheck. - admit mistakes when you realise them, explain your reasoning and why you did the action. - learn from your mistakes, but accept that being error-free is simply not possible.

aklemm 6y ago

Absolutely right, and further, we in tech know better as we could walk into so many big name shops and not be surprised to find huge, simple, obvious security holes. We know it’s standard operating procedure too often, so this blaming an intern rings hollow.

hnlmorg 6y ago

Agreed. All this statement does is reinforce the speculation that there was a failure of process but adds to that that there is a culture of blame rather than a culture of improvement. If a mistake happens, don't blame the individual, blame the process then find a way to fix that process. If a company has a blame culture people spend more time covering their own arse instead of building safer processes.

jrumbut 6y ago
This is such an extreme example of a culture of blame, testifying to Congress that an intern did it 3 years ago?

itsdrewmiller 6y ago

They said in the article they don't know if this password was even related to the breach (meaning all of these points are not really describing reality, especially #3). It's not very clear what the password was for from the article. Sounds like the CEO doesn't have a very good understanding of what Github is though unless this intern was POCing github enterprise or something though.

camjohnson26 6y ago
How could this password even be “leaked”, it’s so trivial that it would be on a list of first 10 passwords you would guess.

coding123 6y ago

4) What was the user name? A password should be no good without a user name.

austincheney 6y ago

The same is true of passwords now since the invention of rainbow tables. The best way, aside from voluntary disclosure, to compromise any password is brute force. The best way to eliminate brute force is to require a long minimum character count and to hash passwords using a 512bit hash algorithm. Imagine the size of a rainbow table of SHA512 or SHA3-512 hashes for a 60 character password. A 60 character password could be as simple as: * I enjoy driving my tiny white car with a standard transmission. * My big cat, Ace, really sleeps a lot during the day while I work! * Growing up my favorite song was Time by Pink Floyd about regret :(

GordonS 6y ago
For most passwords, you should be using a password manager, which means long, high entropy passwords (which will not be memorable as a result). For the few that you need to manually enter, something long is good, but it should ideally use characters or different classes, and ideally not be comprised solely of dictionary words (which your first example is), otherwise the search space is greatly reduced. Also, manually entering a 60 character password is not going to be fun :) I think the longest "manual enter" password I have is 25 characters, and it's a PITA to enter in a password field!
- austincheney 6y ago
  > high entropy passwords You only need that to impose a greater character width against brute force attacks. That is the only value in high entropy. The actual reason people think they need this is because it was written into a NIST publication a very long time ago and it just became common practice. As a proof of concept what is the published standard that imposes that practice? I bet you think you need this but cannot find the written standard guidance suggesting it. The guy who originally wrote that standard later came out and said it was a mistake. Bad advise that he wishes he could take back, but it’s too late everybody thinks they need it and they don’t know why or where that guidance even comes from. > and it's a PITA to enter in a password field! Only on a touch screen. My first example also contains uppercase and punctuation. Think of it like IPv6. When the key space is large enough you don’t need a bunch of bullshit and gimmicks to ensure uniqueness.

mojomark 6y ago

> > So let's analyze the various scenarios under which the "intern" might have been responsible, and why each one is bullshit. "you can delegate authority, but you cannot delegate responsibility." [1] This CEO is a very poor leader. 1. https://www.theleadermaker.com/you-cant-delegate-responsibility/ https://www.theleadermaker.com/you-cant-delegate-responsibil...

toast0 6y ago

> Counter: Why did an intern have a level of access such that their account being breached could lead to this level of compromise/exfiltration? I've worker with interns whose major redeeming quality was that their internship was fixed length and would be over soon. I've also worker with interns who demonstrated ability and responsibility sufficient to get the same access that I had (and, clearly, an offer letter). That it was an intern doesn't mean the level of access was inappropriate; of course, if it were my intern, I would take blame for them leaving their password on github.

saagarjha 6y ago
Is it not usual for an intern to get access to the repository and production databases like a new employee would?
- alisonkisk 6y ago
  It shouldn't be usual. Temps don't get unsupervised access to sensitive systems. Too much risk of abuse and misuse from short-term less mature employees.

ukj 6y ago

2-factor authentication would've mitigated any one of the above failure points.

tinus_hn 6y ago

In many companies any account password is critical, because any account allows access to the company network and internal security is weak.

lawnchair_larry 6y ago

Are you a college student? Or an independent contractor? I don’t know how anyone who has worked in the real world can have these misconceptions. 1) Every password policy allows for dumb passwords in certain places. Because password policies are only enforced on systems that integrate with the password policy enforcement mechanism. Which never covers everything. Even with a password policy, it’s easy to make dumb passwords. 2) It doesn’t say that the intern chose this policy or that it belonged to something critical. There has been no link established between that password and the breach. A random researcher said they found the password a year ago and reported it. It could have been used, but there’s no reason to believe it’s relevant. 3) Nothing suggests that they did. Conclusion: It’s better to not be an armchair quarterback after a breach, especially when it’s still under active investigation by actual professionals with access to actual data, and they aren’t even making the claims that folks here are making.

bawolff 6y ago

If the entire security of the company rests on every intern being fully competent, that's the higher ups fault.