4 ms·

Our security auditor is an idiot. How do I give him the information he wants? (2011)

• SilverElfin 8mo ago
  Is this real? Some auditor is asking for everyone’s raw passwords?
  • gurjeet 8mo ago
    As outlandish as it sounds, I don't have a reason to doubt the validity of this claim. On a tangent, I wish I had appended (2011) to it.
  • ddtaylor 8mo ago
    I have seen this in a banking scenario. I later changed my password to an insult and for sure he knew that too!
• rurban 8mo ago
  This is hilarious. Unfortunately not entirely fake. I myself had an totally unqualified idiot to do a security audit on a TLS implementation. He probably came from web security audits and insisted to get mime checks for the private and public keys. Ha! These keys where files on disc. I told him he was wrong. Management was helpful to bypass the idiotic parts.
• deleted 8mo ago
  [deleted]
• futune 8mo ago
  My first thought was red team. Anyone that is capable of complying to the request is in breach. Ctrl-F "red team" found nothing. But then I read the answers and apparently a couple of them had the same idea. Not sure why it's not the most upvoted option, it seems like the only one that is is not self refuting, as the sincere version of those hypothetical businesses would starve from terminal stupidity... Perhaps my reasoning is wrong?