5 ms·

Holy mac-shit-snacks! "..got access to the dashboard as a Super Admin in less than 1 minute. The password of this guy was the same as his username." AND credent

by Pick-A-Hill2019 5y ago

Holy mac-shit-snacks! "..got access to the dashboard as a Super Admin in less than 1 minute. The password of this guy was the same as his username." AND credential reuse. Ouch. Ding, Ding, Ding! I think we have a winner for the fastest way to the unemployment line.

deleted 5y ago
[deleted]
junon 5y ago
Firing employees for not knowing proper security practices is like being a teacher and firing your student for not knowing the answers on a test. The employer should be performing proper audits and password rotations and/or educating their employees. It should never be "stupid users", but "stupid me".
- ThePadawan 5y ago
  Not parent, but I reckon that a company might see "oh this employee didn't follow our clearly signposted security guidelines, let's just fire them and get on with our lives" as an easier way out than "we have to actually start to invest into security". I'm not saying that's good, but I could definitely see it happening.
  - junon 5y ago
    Yes unfortunately this is also the case - but many companies don't even have the "clearly signposted security guidelines" to begin with.
    - eb0la 5y ago
      With GDPR you must take security into account from the design. If you don't do this, the customer DPO might stop the project anytime, or you would have to undo all the reso it again untilt the DPO approves it.
- Pick-A-Hill2019 5y ago
  I have no wish to start a flame-war here but I would politely disagree with your point of view. Even non-techie users are taught not to reuse credentials. Sure, they still do buuuttt...as an Admin for a 300+ client CMS system ... to not know any better is inexcusable. Even if they didn't know it at the time of starting out in the industry - at what point would they be so blind as to not know / have read about hacks of others and/or the existance of haveibeenpwned and seen the error of their ways? Sorry but no. No.
  - junon 5y ago
    > to not know any better is inexcusable Where are they supposed to get this information if they're never taught it? > at what point would they be so blind as to not know / have read about hacks of others and/or the existance of haveibeenpwned and seen the error of their ways? Most people outside the tech departments have no idea what those things are. They think hacking is stuff that happens in movies, not in real life. Sorry, but yes yes.

deleted 5y ago

[deleted]

junon 5y ago

Firing employees for not knowing proper security practices is like being a teacher and firing your student for not knowing the answers on a test. The employer should be performing proper audits and password rotations and/or educating their employees. It should never be "stupid users", but "stupid me".

ThePadawan 5y ago
Not parent, but I reckon that a company might see "oh this employee didn't follow our clearly signposted security guidelines, let's just fire them and get on with our lives" as an easier way out than "we have to actually start to invest into security". I'm not saying that's good, but I could definitely see it happening.
- junon 5y ago
  Yes unfortunately this is also the case - but many companies don't even have the "clearly signposted security guidelines" to begin with.
  - eb0la 5y ago
    With GDPR you must take security into account from the design. If you don't do this, the customer DPO might stop the project anytime, or you would have to undo all the reso it again untilt the DPO approves it.
Pick-A-Hill2019 5y ago
I have no wish to start a flame-war here but I would politely disagree with your point of view. Even non-techie users are taught not to reuse credentials. Sure, they still do buuuttt...as an Admin for a 300+ client CMS system ... to not know any better is inexcusable. Even if they didn't know it at the time of starting out in the industry - at what point would they be so blind as to not know / have read about hacks of others and/or the existance of haveibeenpwned and seen the error of their ways? Sorry but no. No.
- junon 5y ago
  > to not know any better is inexcusable Where are they supposed to get this information if they're never taught it? > at what point would they be so blind as to not know / have read about hacks of others and/or the existance of haveibeenpwned and seen the error of their ways? Most people outside the tech departments have no idea what those things are. They think hacking is stuff that happens in movies, not in real life. Sorry, but yes yes.