Hacker News Reader

so yeah, dev have access to the password of your account, but really they dont need it, they probably have access to the hash in the database and login anyway. So really NO harm have been done

View on HN

Having (read) access to the hash shouldn't give any access to the account.

Edit: You've made this comment twice in these threads. It's wrong.

Yeah I was wrong, it is only true if the dev has access to the prod database

It is neither a standard practice nor a best practice to give your devs access to your production auth databases.

Perhaps not in more mature organizations, but it's standard practice at every startup I've ever worked for. One place had the dev office VPN'd into production at all times.

Did any of those startups have 200-600 million users?

No, these were small organizations. I'm just saying it's not uncommon. Sadly, some places don't even have a dev environment...

Reply on news.ycombinator.com