4 ms·
One site I went to lowercased my password before storing it unencrypted in the DB, which I only discovered after failing to log in and asking for a password res
by alisonatwork 4y ago
One site I went to lowercased my password before storing it unencrypted in the DB, which I only discovered after failing to log in and asking for a password reset mail, so it helpfully emailed me my clear text lowercased password.
- cdaringe 4y agoIncredible. Please tell us who did this, not to shame them, bit to help us!
- alisonatwork 4y agoIt was an online store I bought something from quite a few years back. I would hope most stores are using more modern back ends nowadays that doesn't allow this to happen.
- skim_milk 4y agoI worked at a place that did this, case-insensitive passwords and all. The worst part? They had unencrypted production database backups on all of their dev laptops, the majority of which left the premises after every night. I couldn't get a figure of how many laptops were lost but statistically speaking there had to have been at least 3 lost laptops with unencrypted production database backups per year using industry statistics. Eventually I convinced leadership to invest in basic security after conservative but still embarrassingly high 6-to-7-figure estimates of annual loss expectancy that only took a measly 5 figures a year to eliminate 75% of the risk, but the company only went around to it a long while after I left the place.
- sshine 4y agoI have former employers who still didn't fix the security bugs I uncovered years after. I don't know what makes a manager turn off snooze on open PRs for fixing blatant holes. But if you've got that skill, it can take you far!
- donalhunt 4y agoI think the lesson is "stop asking for permission and just do want is right". It's rare that a manager needs to approve a PR - would be a culture smell for me in an org.