3 ms·

Only once. At Facebook: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecur

by heyoni 5y ago

Only once. At Facebook: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...

jacquesm 5y ago
And google: https://www.theverge.com/2019/5/21/18634842/google-passwords-plain-text-g-suite-fourteen-years https://www.theverge.com/2019/5/21/18634842/google-passwords...
- dylan604 5y ago
  I knew it was definitely more than once. If it gets done at places like FB & G, then you know other smaller places are doing/have done it as well. They just didn't make the news, nor know it isn't a bad thing.
  - toyg 5y ago
    I mean, what if we have to troubleshoot an issue that is due to, say, the character encoding of such password? We need to see it, right? (yes, such an issue would likely indicate you're not handling that sort of data in the right way, but fixing that would probably take three weeks and the PM is screaming FIXITNAOO because the customer is on the phone...) (I'm not condoning this, just saying that it can look sensible at the time)
    - dylan604 5y ago
      No. Just NO NO NO. Passwords should be treated as sacrosanct. There are other ways of testing encoding. Looking at someone's password should be anathema to anyone. That's like wearing mirrors on your shoes trying to look up places one shouldn't be looking. It's just naughty to the point that any normal person would think it wrong to be doing it. Those kind of requests should actually be reported immediately. Stand up for yourself, for your fellow devs, for 'all humankind' and tell that PM making the request to pound sand (politely). If still pushed, go report them to the next rung up. "Because orders" is not a valid excuse.
      - jacquesm 5y ago
        Even for a honeypot?
        dylan604 5y ago
        ugh, now you're going to make me feel dirty for saying maybe are you running honeypot as white hat to attract "bad guys" to then flip the table? if you're a black hat trying to do bad then you already don't care about morals, so the question is pointless.
- rob74 5y ago
  ...and you can assume that for every case you hear of, there are at least 50 that you didn't hear of, because if you do end up logging passwords, it's something you're likely to want to keep under wraps if possible.

by heyoni 5y ago

jacquesm 5y ago

And google: https://www.theverge.com/2019/5/21/18634842/google-passwords-plain-text-g-suite-fourteen-years https://www.theverge.com/2019/5/21/18634842/google-passwords...

dylan604 5y ago
I knew it was definitely more than once. If it gets done at places like FB & G, then you know other smaller places are doing/have done it as well. They just didn't make the news, nor know it isn't a bad thing.
- toyg 5y ago
  I mean, what if we have to troubleshoot an issue that is due to, say, the character encoding of such password? We need to see it, right? (yes, such an issue would likely indicate you're not handling that sort of data in the right way, but fixing that would probably take three weeks and the PM is screaming FIXITNAOO because the customer is on the phone...) (I'm not condoning this, just saying that it can look sensible at the time)
  - dylan604 5y ago
    No. Just NO NO NO. Passwords should be treated as sacrosanct. There are other ways of testing encoding. Looking at someone's password should be anathema to anyone. That's like wearing mirrors on your shoes trying to look up places one shouldn't be looking. It's just naughty to the point that any normal person would think it wrong to be doing it. Those kind of requests should actually be reported immediately. Stand up for yourself, for your fellow devs, for 'all humankind' and tell that PM making the request to pound sand (politely). If still pushed, go report them to the next rung up. "Because orders" is not a valid excuse.
    - jacquesm 5y ago
      Even for a honeypot?
      - dylan604 5y ago
        ugh, now you're going to make me feel dirty for saying maybe are you running honeypot as white hat to attract "bad guys" to then flip the table? if you're a black hat trying to do bad then you already don't care about morals, so the question is pointless.
rob74 5y ago
...and you can assume that for every case you hear of, there are at least 50 that you didn't hear of, because if you do end up logging passwords, it's something you're likely to want to keep under wraps if possible.