Hacker News Reader

The worst part about that story to me is that you are storing your customers passwords in plaintext apparently? Is this common practice?

"logged their password", so my guess is that they did something like: if(login == competitor): print(password)

Ok understood. I guess it shows how much trust you are putting in an org by using their software, (and anecdotally how apparently willing people are to break that trust)

Sort of.

But trusting an organization not to look at your password shouldn't be something you ever need to do.

As a user, you should always assume incompetence/maliciousness and avoid password reuse.

Password managers make this dead simple; You still have to trust someone (sort of, Bitwarden is open source), but it mitigates this attack elsewhere.

Yes, that's what we did, then waited for their next login.

« We logged their password, just to make sure they were not reusing that of their corporate mailbox »

"Just to make sure", for what, altruistic reasons? Just say you did it for shits and giggles, which is probably more accurate.

We did it for shits and giggles.

Third note: when accepting passwords, hash and salt them !

hashing and salting wouldn't really have helped in this situation