Hacker News Reader

Comment by polote | Hacker News Reader

Why is that an issue ? devs will also likely have access to the hash of the password of a user, and then access his account.

We dont care if passwords are leaking, this is your issue to not use the same password on all websites. Password are not really a private thing for developers inside a company

View on HN

It's an issue for the same reason storing passwords in plaintext in the database is an issue. Reading the hash != access to the account. Passwords should be private to everyone except the account owner. If devs have access to all user passwords then you have a fucking issue.

On many systems, "real passwords" are just a tcpdump away (most sites aren't doing end-to-end TLS. It's TLS terminated at the load balancer / proxy level, everything else is in the clear.)

Also true.

That is a much smaller issues than passwords stored in logs, because the people who have access to running tcpdump usually also have the ability to intercept traffic in other ways (e.g. by updating the application to log all traffic or by inspecting RAM). On the other hands access to logs is usually handed out to a much bigger group of people.

True, but thankfully service meshes like Istio are increasingly used which encrypt the traffic between each service.

>Why is that an issue ?

Are you serious?

>devs will also likely have access to the hash of the password of a user

No, devs should absolutely not have access to the password hashes of users in a properly configured environment

Reply on news.ycombinator.com