4 ms·
From the article, it sounds like the passwords are indeed stored in cleartext: > On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password
by inetknght 5mo ago
From the article, it sounds like the passwords are indeed stored in cleartext:
> On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter. That password was subsequently used to access that individual’s email account without authorization.
- giantg2 5mo agoIt still blows my mind. Shouldn't the government audit their contracting companies for egregious issues like this? Seems extremely reckless not to.
- at-fates-hands 5mo agoI'm pretty shocked as well. I thought every company stopped doing this like 20 years ago? Even for a legacy system that is a long time to continue storing credentials like that.
- jeremyjh 5mo ago20 years is rookie numbers in these systems. I guarantee it’s been at least 40 years since a single fuck was given.
- __turbobrew__ 5mo agoMy wife works in IT at a mid sized city. They still store credentials in source control.
- njovin 5mo agoI've been through a handful of SOC2 audits and they've never asked us to _prove_ that we aren't storing passwords in plaintext or with reversible encryption (we weren't). This is why so much of vetting & compliance is toothless. You can have robust change management, physical security, network security, identity management, etc. policies but absolutely nobody wants to spend enough on audit & enforcement to make them meaningful. The gov't will make you _claim_ that you do all of these things before awarding a contract, but they won't ever check. Good actors will do the right thing regardless because they know the consequences of cutting corners.
- lazyasciiart 5mo agoSee: the entire existence of Delve https://www.iansresearch.com/resources/all-blogs/post/security-blog/2026/04/19/delve-allegations-expose-weak-points-in-modern-compliance https://www.iansresearch.com/resources/all-blogs/post/securi...