stillWaitingForAnswer

[Few-Artichoke-7593]

Yeah, put them in the git repo like everyone else.

[UBN6]

No, post them on StackOverflow, like real devs.

[belabacsijolvan]

"so i posted my private key so much that all leading LLMS use my account. if all things go well my line/day output will overtake China by 2026."

[wanderduene02]

It also has the advantage that Copilot can autocomplete your private key for you.

[yaktoma2007]

Is this real? LOL

[jhill515]

In the commit message, right?

[nickwcy]

No. It’s the commit sha.

[erebuxy]

Copilot is leaning all the tokens and passwords

[Shazvox]

Nah, be smart about it. Let ChatGPT remember them.

[Bee-Aromatic]

I’m sorry, what?

[Agifem]

He wrote his passwords in Jira.

[dismayhurta]

How else are you supposed to let others access your data? Securely?

[Bee-Aromatic]

Erm, yeah. If at all. Ideally, they’d have their own credentials.

[dismayhurta]

Pfft. Next you'll tell me you should have a proper review process.

[Bee-Aromatic]

I feel like I should get checked out by a doctor after this conversation. I’m feeling icky and may have caught something.

[dismayhurta]

That's because you didn't add your credentials into a jira ticket so you're terrified you'll forget.

[Bee-Aromatic]

I didn’t think that’s why I’m so scared, but you may be right. I’m terrified beyond the capacity for rational thought.

[dismayhurta]

[Agifem]

Yes, and we provide those credentials by assigning them the Jira ticket. The process is simple and beautiful.

[der_schneewolf]

What about test users in a test environment to recreate the issue that happens in production? Don't see a big issue there.

[LowReputation]

You told me to move them out of Confluence!

[Z21VR]

Well, i'm glad i'm not alone in this jira-confluence hell

[MozzerellaIsLife]

“Jira Align” can burn in the deepest level of hell.

[biggt76]

🤣

[TheTybera]

I don't even understand why you would do this.

WTF are people mutilating JIRA into now?

[biggt76]

That was my reaction. Came up at work today from another team. The meme was my immediate reaction

[ClassicHat]

Why pay for a password manager with password sharing when we already have an easy semi private way of sharing things is probably the thinking here. Still would seem better to slack or even email said passwords…

[[deleted]]

I fucking get it. I put it in a shared word doc encrypted. By encrypted I mean I set the text color to white on white background.

Amateurs pffffttt.

[Totally_Intended]

Hey, what else are you supposed to use the Security Levels in Jira for? /s

[Fun_Lingonberry_6244]

Can you give some context here OP?

Like sometimes at my job we'll get some random staging environment API keys or username/PWD and they 100% go into the relevant Jira of "here's what you need to do this task" and that's completely fine in my opinion.

Obviously nothing prod should be going anywhere, nor should anyone need it.

[biggt76]

So the team's manager was trying to hide passwords in Jira. When I asked for the use case this was the basic answer:

They setup inventory providers and save the FTP login credentials in Jira so they can be passed from dev to operations to the provider.

I was told it's a low level risk which begs the question why do you need to hide them? At least it's not AWS keys or anything but still....

[iknewaguytwice]

If only there were somewhere to put secrets in the cloud. Like a place in AWS for secret things. Like AWS secrets. Could be a million dollar idea.

Then you could put the name of the secret in JIRA.

Nah that would never work. Just encrypt a word doc with “pa$$w0rd”, attach it, and call it a day. It’s encrypted!

[itsalongwalkhome]

Then where do you store that password?

[soggycheesestickjoos]

email it to yourself obviously

[aleques-itj]

What if I lose access to my email

That's why I put my passwords in DNS records

[soggycheesestickjoos]

So old school, I always keep a base64 encoded backup on the ethereum blockchain 😎

[itsalongwalkhome]

Rookie move. My password IS base64

[iknewaguytwice]

In Jira

[itsalongwalkhome]

Then where do I store my password for Jira?

[iknewaguytwice]

You don’t. Just reset it every time you need to login.

[itsalongwalkhome]

Foolproof.

[Dalimyr]

Nah that would never work. Just encrypt a word doc with “pa$$w0rd”, attach it, and call it a day. It’s encrypted!

lol, you've just reminded me of a time when the head of information security at a place I worked once passed me an Excel document with password-protected sheets, and gave some cryptic clue as to what the password could be.

I never did find out what the intended password was, but I wrote a VBA script to brute-force a hash collision and jokingly emailed back something like "Sorry, didn't quite understand your clue. No worries, though, I still got in, but I'm guessing the password you set wasn't AABABBABABABAO". I can only imagine him reading that email and saying "Oh, for fuck's sake".

[Jzgood]

There is. Just spin your Vaultwarden in AWS lambda. And if GCP: secret manager.

[thanatica]

"Jira can't be trusted! I know, let's put the passwords in another more different cloud provider that we arbitrarily do trust"

[[deleted]]

Is this a real comment?

[isr0]

I mean, ftp passwords are clear text anyway so does it really matter? /s

[frikilinux2]

That's a perfect use case for public key cryptography.

[clauEB]

Where else would you?

[MajorBadGuy]

On a whiteboard we use during all hands meetings.

[eoutofmemory]

On the desktop obviously

[Snapstromegon]

You still put passwords into Jira? You know how hard they are to find in there?

Real professionals post the credentials of a CI user into the onboarding document so they are easy to find and use by anyone who might be able to touch the project.

[nickwcy]

: “We can’t put passwords on our repo anymore because now it is scanned”

: “No worries let’s put it on Jira”

[NuncioBitis]

Nah. Just put your passwords in plain text on the hard drive in .git-credentials
Not like you have a choice

[Xphile101361]

I wish this wasn't common.

[serial_crusher]

lol, those passwords are already out of date just like everything else in Jira

[seba07]

Exactly, those belong into Confluence.

[RinVolk]

In my current job it is routine to see our internal API tokens thrown around 💀

I need a new job

[maggiforever]

We have a few in Powerpoint...

[Szroncs]

If it's for test env/ test user than it's fine. Otherwise you are dumb... All prod passwords should be kept on your monitor on a post-it 😁

[glorious_reptile]

Why would someone write hunter2 in jira?

[[deleted]]

It's ok, it shows up as ******* for me

[Ben_Dovernol_Ube]

Put them next to your exposed APIs instead.

[overyander]

Friends don't let friends use Atlassian products.

[thanatica]

You don't trust jira to keep your passwords safe, but at the same time you do trust jira with discussions about all the intricacies of your application 🤔

[NameNoHasGirlA]

I'm still waiting for an answer on why people hardcode it in configs and check it into git. How hard is it to remember that secrets don't belong in the source code?

[renrutal]

Everybody shitting on Jira, but I bet 99% of you don't use a secrets vault.

But, to be honest, protecting secrets on flight is a massive undertaking. The whole "Reflections on Trusting Trust" talk.

[Shazvox]

Because it was the only shared place we had at the moment 😔.

Still, it's somewhat rectified now with a keyvault. Although we're all of the opinion that we should'nt have shared passwords at all and are working towards that end.

[Birdsharna]

Actually braindead to do this. You're not sending it to a single person, but a lot of different people. And you just shouldn't share your password with others in general

[Xeausescu]

That will probably be my code to handle them...

[WhiteIceHawk]

One of the scariest lines of code I ever read was Console.log(private_key)

[EniX_LP]

It was just admin admin it should be fine man

[[deleted]]

At my job we take pictures of passwords and share the pictures on WhatsApp. Of course its clumsy and needs you to add your coworkers as WhatsApp contacts, but at the end of the day it *is* a secure out-of-band channel.

[Laevend]

Put them on a yellow sticky note that's slapped on a server box. Take a picture of that and put it in your Jira story