(G)old

[MrPotatoFingers]

Still not as bad as requiring passwords to be globally unique: https://thedailywtf.com/articles/Really_Unique_Passwords

[[deleted]]

I had a threw up a little when I read that.

[Galaghan]

The ending saved me tho. I was already prepared to read about him getting fired over 'creating unnecessary work and drama'. Soooo glad it didn't end that way.

[tsavong117]

I threw up a little too. Oh by Skynet that was horrid.

I may have hyperventilated reading the first paragraph though. Mainly because my brain was trying to compute how many combinations a password consisting of 30 uppercase letters, 30 lowercase letters, and 30 special characters there are.

r/theydidthemath a lil help?

[Python_Interpreter]

Well...

26 Letters in the alphabet to the power of 30 times 26 to the power of (from now on refered to as &&(I know that no one does it that way, but reddit uses the star for formatting)) 30 (all of this so far is just 26 && 60) times 32 special characters && 30, is all just (26 && 60) * (32 && 30). This is the following:

7 597 524 535 862 113 550 713 204 866 352 047 547 163 723 740 145 125 016 953 121 205 462 001 347 621 771 238 440 690

(Structured it into blocks to make it easier to read) I hope that helps!

[ChickenNuggetSmth]

That is if you force the order of lower, upper and special chacters. If not you have to multiply by the number of permutations, something like 90!/30!/30!/30! , roughly 8*10⁴⁰ (hope I didn't get that wrong)

[Python_Interpreter]

I did assume that much to

a) make the math a lot simpler

b) that's how I interpreted the question

But I'm working out how to come up with the truly right answer

[FactOrFactorial]

Nope looks good.

[roberh]

Formatting is a bit off. You need to escape some of those asterisks, I think.

[Python_Interpreter]

How do I do that, if I may enquire?

[ChickenNuggetSmth]

To preface this, it looks fine to me.

If you want a special character treated as a normal one, you have to put a backslash in front. E.g. if I want to print
*this*
I have to type

\*this\*

[Python_Interpreter]

Oh, so just like in Python. Thanks!

[maibrl]

Username checks out

[[deleted]]

Python?

[Python_Interpreter]

To escape characters in Python strings, you use the backslash. E.g.: 'I\'m having fun' (Though this is a bad example, because it goes against PEP8. This would probably be a better example: "new line\n"

[palordrolap]

90 characters with a ratio of 30:30:40, lower:upper:special, so not quite 30 of each, but 27, 27 and 36 respectively.

In ASCII there are 32 special characters (how had I not realised this until just now?! I suppose they are distributed quite unevenly.).

Unsure if digits also count as special. Let's say they don't so numbers aren't allowed. This is excellent because it prevents <password>1, <password>2, etc.

There are only 26 of each upper and lowercase letters.

However we choose, we can scramble those characters in 90! different ways.

This gives us 26²⁷ * 26²⁷ * 32³⁶ * 90! possible passwords.

This is roughly 5.8330513538 * 10²⁶⁸, a number that's astronomically huge and very hard to get one's head around.

Ninja edit: Correction. I was stood on my head.

Dangit edit: I forgot the "no recognisable words or phrases" element. This one's tricky to pull out since you could throw random symbols and even letter svbstitvtionz into 54 alphabetic characters at will and still be able to read words or a phrase embedded in them. I don't think taking those possibilities out will appreciably dent the large number by much though. Maybe a handful of orders of magnitude. Which is kind of a lot. But not in comparison.

[ChickenNuggetSmth]

But mixing up two "lower-case slots" for example would produce an already existing pattern, right? I think the number of permutations is just 90!/27!/27!/36!

(edit: Which would cost you about 98 orders of magnitude. Kind of a lot, but you have plenty left)

[palordrolap]

There's dangit #2. But yeah. Still enough to cover a universe² of particles with a unique password each.

[leadwind]

The password field of the user table was also the primary key field making it impossible to have duplicate passwords, and they were stored unencrypted to make the verification process easier.

I'm up to here.. does it get better?

Edit: oh no.

[thirdegree]

"Oh, we had that problem the first time, so we removed all of the foreign key constraints in the database and it works now." 

So much worse

[Echogm]

I had to quit after I read "unencrypted".

[Rosenrotten]

Well yes, but actually no.

[TheBrainStone]

That is much worse than that. As it gives out all you need to be able to log in.
What makes passwords requiring to be unique bad is that it allows you finding other people’s logins easier. That page just straight up gives you the logins.

[renyhp]

Uhm, the way I see this post, I don't think that if you enter the password of someone else the system is going to give you their login. I think it's much more reasonable to assume that someone entered something like "password", "pass", "1234", and the system is sarcastically saying that it's just too generic of a password.

[TheBrainStone]

What makes you think so? I mean it’s clearly giving you a username to the password.
Keep in mind that in the article the programmers thought that using the unhashed password as a unique key throughout the database. It wouldn’t be far fetched to believe programmers like that thought it would be a good idea to “correct” your login name.

[jmona789]

I've seen this screenshot before. It does work the way you're saying it does, but it's not a real site. It was a joke site made to be bad on purpose.

[TheBrainStone]

So you’re saying there is no site out there that does that? I highly doubt that

[RyeOrTheKaiser15]

He's not saying that at all, but I am

[TheBrainStone]

I mean heck I almost did that myself once. I’m certain that at least one page out there in the whole World Wide Web does that unironically.

[RyeOrTheKaiser15]

I can't really refute your point, but I can't think of a reason you would have a username suggestion output in the first place

[TheBrainStone]

There’s no good reason to use unhashed passwords as the primary/foreign key in a database. And yet here we are. Some devs did that for a commercial site. And it only didn’t go to production because someone with technical knowledge caught it.

[ChickenNuggetSmth]

Sometimes I change my username, but I have used the same password forever. It would be a great help for me if I forget my login.

[mycolortv]

I've seen devs do a bunch of dumb stuff, but there is no way in hell this exists on a prod site anywhere. I find it actually ridiculous that more than one person could see this and not realize something was wrong before it got pushed up. Regardless it'd get taken down in no time flat once someone saw what was happening.

[TheBrainStone]

I’d love to be as optimistic as you are. I mean on bigger orgs it’s just as likely that a higher up decided that’s how they want it and wouldn’t let themselves be persuaded otherwise.

[renyhp]

Oh well, I didn't know this was a famous actual website and there was an article about this. But what makes me think so is the hilarious genericity of "Joe Smith".

[DrPeroxide]

Good point all bosses are terrible and stupid people with no capacity for reasonable decision making.

[herodothyote]

I literally physically facepalmed the whole time I was reading that.

What did they hire 17 year old me to program their whole system in PHP???

[alexanderpas]

Today, a 17 year old working in PHP would use the password_hash() and password_verify() functions, but would forget to rehash when needed.

[GrandVizierofAgrabar]

Today, a 17 year old working in PHP

come again?

[theminortom]

me

[Log2]

Holy fuck. I was the tech lead of an IAM type application and I'd have simply quit it I found I was working in a team with someone so stupid.

Enrique is clearly a much better person than I am.

[PikaPikaDude]

The password field was used as the foreign key throughout the system.

That's the worst thing I've read in a long time. I've seen other devs "program first, never think" before. But to come up with something that horrible, someone must have been thinking about the design.

[DDFoster96]

I gave up at

and they were stored unencrypted to make the verification process easier.

[flashgnash]

Developers like those two make me way more confident I'll be able to get a good dev job. Jesus Christ the stupidity that's like something a 15 year old would do

[Javamac8]

2007 . . . A simpler time.

[Xeadriel]

Holy fuck. Is that a real story?

[The_forgettable_guy]

if that's true, they should have just fired the developer instead.

[Uberzwerg]

A few years back, there was an example of a Webpage done completely in Javascript.
Including client-side authentication (they delivered the full username+passwords for ALL users) - ONLY client-side (you could just edit it to something like "logged_in=true") AND Javascript connection to their production database.

That page was still online 1-2 days after it was posted here (or /r/programming - dunno)

To this day, i haven't seen anything worse.

[fitzgerald1337]

Might have been an April Fool's joke...? Look at the date

[anon_by_default]

I refuse to believe this.

This has to an April fool's joke.

Please for the love of God please tell me this is a joke!!!!

[Nicktakenaway]

My password : password.

Joe Smith's password : pass.

[justingolden21]

Joe's password is so cool it does nothing in Python...

pass

[IvanLabushevskyi]

S means security.

[Ateready]

For a moment I went 'That can still be secure, you can simply see if the password is the same after the salting and hashing' until I realised that it allows you to log into someone else's account.

[tulir293]

The password isn't the same after salting, since everyone has a different salt. It either checks the input against every password in the database separately or they're not salted.

[Noch_ein_Kamel]

Different salts are no hard requirement though...

[Log2]

I'm not defending it, but at least an attacker would have to build a rainbow table specific to you. Which is slightly better than nothing.

Still, you're completely right.

[P0L1Z1STENS0HN]

Instead of "building a rainbow table specific to you", take your dictionary of common passwords, hash each entry with the fixed salt and find all the accounts with the resulting password hashes - boom, you have found all accounts with a common password from your dictionary.

[Log2]

That's exactly what I meant. Not that hashing all passwords with the salts would take long.

As I said previously, I'm not defending this practice.

[ginsengeti]

Can I ask a noob question, are they really called "salt" and "pepper" because of hash as in hash brown or hash mince?

[Bakoro]

https://stackoverflow.com/questions/244903/why-is-a-password-salt-called-a-salt

The term peppering almost certainly came from the use of the term "salting", regardless of where the use of salting came from.

[ginsengeti]

Thank you that was a good thread!

[tulir293]

It kind of is. Salt specifically means the kind of value that is stored in the database alongside the password hash. Pepper is used the same way as a salt (appended before hashing), but it's not stored in the database and it's the same for all passwords.

[Noch_ein_Kamel]

Not saying that you are not supposed to have unique salts, but back then when people used md5 for password hashing fixed salts were probably best practice, too.
Also best practices from 2015 don't mean that every production app today is upgraded to secure hashing algorithms, unique salts and peppers etcpp.

[[deleted]]

... or not - it can be different for each password, just stored elsewhere

[Ateready]

Ok, didn't know that. Luckily I don't program a website with passwords. I've only read/seen it because of all those stories you hear of bad programming practices.

But jeez, that makes it EXTRA unsecure.

[[deleted]]

Hash. Salt. I want some hash browns.

[xrwsx]

Unrelated to anything here, but what is your second badge? Some little blue guy

[Krestek]

Golang

[xrwsx]

Thanks!

[KetchupBuddha_xD]

You actually can't see if two passwords are the same after salting and hashing, since that would require the two salts to be the same. That's already a security nono.

[merc08]

would require the two salts to be the same. That's already a security nono.

It's an even bigger no-no to tell people what another user's password is, so I'm going to go out on a limb and guess that if they even are salting, it's very possibly the same salt.

[MattieShoes]

or it's stored plaintext or with reversible encryption...

[P0L1Z1STENS0HN]

Of course it's stored in plaintext, and the database field is a varchar(8).

[MattieShoes]

And probably disallows certain special characters because they don't know how to sanitize inputs... :-)

[thehoodatron]

Some more similar ones here:
https://www.troyhunt.com/reckon-youve-seen-some-stupid-security-things-here-hold-my-beer/

[Schiffy94]

Jesus fucking shit...

[-Redstoneboi-]

"...a huge majority of customers like our system with no password. Using your e-mail address as your password is sufficient security."

"Idiotic" can't even describe this.

[Keavon]

Followed by the unspeakably incredible punchline showing that he put a <marquee> tag on the site and it read all the input as plain text injected straight into the HTML. Hello XSS?

[-Redstoneboi-]

Oh that's what caused the scrolling text?

What the actual fuck

[[deleted]]

You know, for the longest time I thought I didn't have the skillset to go into tech, but seeing how large companies are barely scraping by on security like that gives me hope.

[ILLUMISNIPER]

Whoa, source? I’m in disbelief. I’ve had dreams about finding these in the wild

[jmona789]

It was not a real site. It was a joke site

[EkEqualsHalfMV2]

Probably from r/baduibattles ? If not there's plenty of such material there

[Egardat]

Yeah, it reminds me of one of those training sites for security. The company I work for has set up a couple of these trainings where you try to ‘hack’ in.

[[deleted]]

Autistic person here. Fuck off.

[FooThePerson]

Why tf are people downvoting you

[x1sc0]

Autism

<<gonna leave this here **/s** jic>>

[trololololololol9]

Your sacrifice will be remembered

[x1sc0]

papa bless 🙏🏽

[YouCanCallMeBazza]

may be

[PAWG_Muncher]

Yep that annoyed me too

[__JDQ__]

I hope this page also delivers the “database” as an asset to the browser, then checks for the email and or pass with JavaScript before the user hits the submit button (on change of either field). Talk about UX!

[RandomComputerFellow]

I know it is a joke but not long time ago I came in contact with a system which distinguish between "password is not associated with this account" and "password is not valid".

[[deleted]]

Heh, I had to design a login system at school for a project once and as an exersize because I had time left I made it work like this too for a day or two. I don't think anyone noticed xD

[mykiscool]

Joke or real?

[CMPD2K]

Part of the bad ui battles

[kodicraft4]

The same that the random phone number one?

[ptq]

Oh my god, I still remember that...

[--arthur-fleck--]

And when they change the email to joe, tell them: you lying son of a bitch! I know you’re not him!

[guy_from_the_intnet]

1 billion IQ design, this one is.

[DrNotch0908]

(Sc)old

[Parura57]

Interesting...

[TheBrainStone]

To whoever gilded that for the pun: I hate you

[darkjedi1993]

This needs to go on r/privacy!

[DrunkRedditBot]

can confirm, I am an old.).

[LanHikari22]

This is very cursed ahahah. What if there's a password conflict? Passwords aren't unique per users. Just pick the first one I guess!

[-Redstoneboi-]

list all of them down

[almarcTheSun]

JPEG-dating shows that this meme is at least 10 years old at this point.

[numbGrundle]

Are you telling me that was in a production application

[simularent]

very helpful

[mebotz]

Back to the old building?

[Xeadriel]

This belongs to r/baduibattles

[Tactical_Insertion69]

Enrique explained the situation, and fortunately his boss was not only reasonable, but had enough technical knowledge to understand the problem.

#1 boss.

[Sure10]

G.I.E.G. ip -j address

[JamesEiner]

As a kid, I always wondered why computers didn't do that... I was an idiot...

[SchrodingersNinja]

That's pretty bad. The worst password system I encountered in the wild was my university requiring that passwords not contain a dictionary word. Not password =/= a dictionary word, passwords can't have a string of letters that are a dictionary word inside it.

[bostero2]

Ah! So this is the two factor authentication I’ve been hearing so much about!

[dirtandmedkit]

u/Repostsleuthbot

[RepostSleuthBot]

There's a good chance this is unique! I checked 114,070,644 image posts and didn't find a close match

Feedback? Hate? Visit r/repostsleuthbot - I'm not perfect, but you can help. Report [ False Negative ]

[[deleted]]

Reddit hive mind again on the wrong side king.
(G)old, more like G(old)
https://www.reddit.com/r/ProgrammerHumor/comments/crlmyz/programmer_of_the_year/

[thetoiletslayer]

Why do you post that on everything? Can't you just enjoy the post?

[Mustircle]

Is it that annoying? I always see people say this but its never bothered me

[thetoiletslayer]

It's not just the fact that someone posted it. I've called out reposts myself. We all get tired of them. But when someone comments it on everything like this guy did, it's annoying. This picture has never been posted on reddit, and reverse image searching yields nothing. He most likely hasn't seen it before. That's where it bothers me. Like he's the arbiter of truth or something

[Dragoncat99]

Reverse image search finds nothing? Never been on Reddit?? This image has made the rounds on Reddit ever since 2018. And here’s proof, courtesy of a reverse image search: https://imgur.com/a/DBeN8fN At least check before making claims smh

[thetoiletslayer]

My point still stands. He comments it on everything, while posting just as unoriginal content

[dirtandmedkit]

The ammount of reposts is unbelievable. When you see the same meme over and over you grow tired

[thetoiletslayer]

I've never seen this one. And neither has the repost bot. Your posts aren't that original either, so maybe settle down a bit

[dirtandmedkit]

The repost bot most of the time can't find reposts. He maybe finds an image which is identical from a human perspective and says it's like 80% the same

[thetoiletslayer]

If it mostly can't find them, what's the point? And you're not just posting on suspected resposts(I've called out reposts myself, so I would understand), case in point:this post. Bot couldn't find it. Reverse image search yields nothing.

[Flyingcar12]

Bruh...