this post was submitted on 13 May 2026

516 points (98.5% liked)

Technology

technology@lemmy.world

87,939 readers

15,890 active

2,689 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

moderators

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

Twin brothers wipe 96 gov't databases minutes after being fired (arstechnica.com)

submitted 4 months ago by FTonsilStones@lemmy.ca to c/technology@lemmy.world

79 comments fedilink hide all child comments

A case study in why credentials are revoked before firings.

you are viewing a single comment's thread
view the rest of the comments

[–] Cytobit@piefed.social 174 points 4 months ago (21 children)

Why were they storing passwords in plaintext in the databases?!

hideshow 21 child comments

[–] LadyMeow@lemmy.blahaj.zone 171 points 4 months ago

First time reading about government systems, eh?

parent

[–] WereCat@lemmy.world 50 points 4 months ago (3 children)

Why not? National Safety Department of Slovak Republic (Narodny Bezpecnostny Urad) had password NBUSK123… just government things

parent

hideshow 3 child comments

[–] testaccount789@sh.itjust.works 31 points 4 months ago (1 child)

No, that was a bit different.
login: nbusr
password: nbusr123

parent

hideshow 1 child comment

[–] WereCat@lemmy.world 4 points 3 months ago

my bad

parent

[–] msage@programming.dev 12 points 4 months ago

The K in password doesnt match Republic in the name.

Totally secure.

parent

[–] echodot@feddit.uk 44 points 4 months ago (6 children)

Because like all critical infrastructure it was setup by somebody's kid on work experience

parent

hideshow 6 child comments

[–] IWW4@lemmy.zip 20 points 4 months ago (5 children)

Or some poor guy who is setting it up, because it is a one off and just get it done project, that metastasizes into a fucking mess.

parent

hideshow 5 child comments

[–] scytale@piefed.zip 7 points 4 months ago (4 children)

Or lowest bidder contractor.

parent

hideshow 4 child comments

[–] IWW4@lemmy.zip 5 points 4 months ago (3 children)

All contracts go to the lowest bidder.

parent

hideshow 3 child comments

[–] village604@adultswim.fan 5 points 3 months ago (1 child)

Fun fact, if the federal government contracts your company for a service, you arent legally allowed to sell it others for less.

parent

hideshow 1 child comment

[–] IWW4@lemmy.zip 1 point 3 months ago

Correct.

parent

[–] Corkyskog@sh.itjust.works -1 points 3 months ago

That's only usually true, but heavily depends on category. If someone is offering some service like software or managing employee benefits it can often be outweighed by other factors.

parent

[–] betterdeadthanreddit@lemmy.world 18 points 4 months ago

It's like leaving your car door unlocked in a bad neighborhood so your window doesn't get smashed for the $.36 in the center console. Attacker might take the prize and go without showing that everything around it is just as poorly-built.

parent

[–] CosmoNova@lemmy.world 8 points 4 months ago (5 children)

Probably for the same reasons web browsers store them in plain text: They don‘t care.

parent

hideshow 5 child comments

[–] OwOarchist@pawb.social 18 points 4 months ago (4 children)

the same reasons web browsers store them in plain text

Why one web browser stores them in plain text. Fucking Edge.

Who knows about the others, but I can pretty much guarantee you that Librewolf, for example, isn't doing that shit.

parent

hideshow 4 child comments

[–] VeganCheesecake@lemmy.blahaj.zone 13 points 4 months ago (1 child)

If you can autofill passwords without authenticating in some way, they are probably either stored in plaintext, or encrypted with a key that is stored in plaintext. Cause, like, how is it supposed to magically encrypt it.

parent

hideshow 1 child comment

[–] wreckedcarzz@lemmy.world 4 points 4 months ago

That's how computers work, dummy. Magic.

parent

[–] railwhale@lemmy.nz 5 points 4 months ago

I believe Firefox (and forks) only encrypt if you have set a master password.

parent

[–] CosmoNova@lemmy.world 5 points 4 months ago

Firefox and chromium browsers also store them in plain text. I know because I literally copied them from a file when setting up my password manager.

parent

[–] JeeBaiChow@lemmy.world 8 points 4 months ago

Well how else would they help the users if they ever forgot their passwords? Duh.

/s

parent

[–] FiniteBanjo@feddit.online 1 point 3 months ago

Pretty sure thats part of the illegal thing done by these two, no?

parent