Auditor's response to "Our security auditor is an idiot" (Update 3)

by sharjeel • 15 years ago

395 137 15 years ago

kaeluka• 15 years ago

the Daily WTF - live!

Please tell me this is a troll. I mean, I've seen some pretty incompetent people doing jobs they're not cut out for before, but I really want to believe this level of incompetence can't actually find jobs.

joelhaasnoot2• 15 years ago

I wish I could be saying I believe he was being tested by the auditor, but it's just gross incompetence...

fadzlan• 15 years ago

Some people excel.... on well... giving good interviews.

Back then, I used to believe that people know what they are doing, but since I've lived long enough know, maybe not.

You gotta be careful, people like that will come to personality attack when push come to shove. When facts are against them, it is now time to yell.

billybob2• 15 years ago

"Some people excel.... on well... giving good interviews."

The sort of interview that this guy would do well in is a poorly-conducted one. A simple question like "what does it mean to hash a password and why would one do that?" or "what is PCI?" would expose his incompetence.

reitzensteinm4• 15 years ago

If this is real, I'll be stunned if the auditor keeps his job.

Then again, after working at startups my whole career, maybe I'm just naive about how messed up the real world is.

patio11• 15 years ago

Customers of a particular gigantic consulting company have to be routinely dissuaded from "passwords similar to any old passwords should not be allowed", which is often in bid documents. To a man, when told the requirement is unsound, they suggest infinite retention of passwords in plaintext plus Levenstein distance and ask the consultancy why their engineers couldn't come up with that obvious solution themselves.

The reason for this requirement to repeatedly pop up in bid documents is misapplication of a poorly drafted standard by people who are theoretically experts at enforcing it's normative intent.

I would love to throw in an additional anecdote here, but it would violate a confidence. Pretend that $500k had been allocated to produce a list of plain text passwords and a combination of bureaucratic inertia, competence issues, and internal politics made that requirement an unstoppable freight train. That gives you the flavor of it.

reitzensteinm4• 15 years ago

While that is an absolutely ridiculous requirement, couldn't it be satisfied securely by creating on the order of 1-10k modifications of each password when created, and hashing those? That would be enough to add numbers to the end, switch case, reverse, randomly change letters etc.

It's a lot of trouble to go through just because of the ignorance of a client, but it would be enough to check that magic box on the requirements list and be done with it, rather than having to go to all of the trouble of trying to educate the client and risk them going elsewhere.

jefffoster• 15 years ago

Has any work been done to solve reusing passwords with homomophic encryption? (this is a scheme that allows you to perform operations on the encrypted text without decrypting it).

robtoo4• 15 years ago

Lots of security standards require passwords to have at least one digit. Lots of security standards require passwords to be changed every so often.

The end result? A user starts with the password "Seekrit1" when they join the company, then the next month they change to "Seekrit2", "Seekrit3", and so on.

This is hardly what the security policy intended, so stopping that happening isn't actually a bad idea.

Obviously storing a complete password history in plaintext (which would even have to be online for the consultants' plan to work) is ridiculous, but pre-calculating a bunch of hashes of similar passwords every time a new password is set would certainly be feasible.

Changing passwords is usually a rare occurrence, but making this at least slightly computationally-expensive shouldn't be a problem. Of course, the more expensive the password-hashing algorithm, the fewer "similar" passwords you would reasonably be able to pre-calculate, which is an odd trade-off to have to make a call on.

One thing to be wary of, though: by pre-calculating and storing a bunch of hashes of similar strings, this opens you up to (what might be called) a related plaintext attack. I have no idea if existing password hashes are specifically designed to be resistant to this, but would guess not. (edit: I didn't think this sentence through correctly. Thanks, Joachim)

fmw2• 15 years ago

You could require users to enter their old password when changing it. That way, you can compare two plain-text passwords without the need for plain-text storage (or pre-computing, like other commenters suggested).

Someone2• 15 years ago

You do not have to retain plaintext passwords to implement that. Just remember the past X hashes, generate all passwords within edit distance D of the new one, and compare the two lists.

Edit distance 3, even with "letter stays letter, digit stays digit, random additions and removals" will already give millions of variants, so this may be impractical, but impossible? No.

praptak• 15 years ago

"maybe I'm just naive about how messed up the real world is"

I'm afraid you might be. Having read the auditor's responses I recognized the tone instantly. Idiots like this do exist - they advance by throwing around lots of buzzwords and touting their "years of experience" which is often enough to bamboozle their equally incompetent superiors.

rickmb• 15 years ago

I'm afraid you are naive.

This is not a lone idiot in an otherwise sane industry. People like this can thrive and remain blissfully ignorant because the entire ecosystem around them is incompetent, from senior executive to junior trainee.

In our industry, entire companies operate in complete isolation, basing their practices on the knowledge of their most "senior" engineer who was there at the beginning, however clueless that engineer might be. Companies like this can continue to operate successfully for many years, moving from one client to the other, and you will find them in any niche of the software industry, including startups.

marchdown• 15 years ago

Why won't someone expose them?

jasonlotito2• 15 years ago

To be fair, startups aren't any different. They do things they shouldn't do just as often. I honestly wish I could share some stories, but I can't. Suffice it to say, don't assume a startup is better just because it's backed by YC or some other fund.

sharjeel• 15 years ago

All startups do things they shouldn't do; they are in the business of experimentation, iterations and improvements. However the important thing is that most of the startups realize their mistakes, acknowledge them, learn from them and move on. In this case, the guy is insistent upon being a nutcase.

mbesto• 15 years ago

> maybe I'm just naive about how messed up the real world is.

Try coming into Enterprise software :)

levigross• 15 years ago

Then again, after working at startups my whole career, maybe I'm just naive about how messed up the real world is. I second this... Working in a startup every time I see someone having to work around corporate BS to get something simple done, this comes to mind.

dasil0033• 15 years ago

I can't help but feel there is some kind of social experiment going on here.

I mean I know there are a lot of incompetent people out there, but a security auditor asking for a list of plaintext passwords is not something that should take more than an email or two to resolve even in Bizarro world. "Techies" exhibiting this kind of willful ignorance are usually a bit better and hiding under their rock.

joelhaasnoot2• 15 years ago

He'd be a good actor, because he clearly doesn't know what PCI compliance is. He mentions PCI should be installed.

nkassis• 15 years ago

I also really feel this guy is trying to get the password by social engineering means or something it just seems completely ridiculous to ask for this stuff. Why would he need the info in the first place? I wished the author of the post had asked him that. I'd like to know his answer to that.

InclinedPlane3• 15 years ago

I take it you've never worked with someone who was truly incompetent. Often such people have some sort of defense mechanism that allows them to cover up their incompetence with some degree of effectiveness. But sometimes it shines right through, and then you end up gobsmacked that it's even possible for someone to be that ignorant/illogical.

But it does happen, I've seen it too many times.

dasil0033• 15 years ago

Sure, but such people can not remain the lynchpin of a PCI auditing operation. I mean how many WTFs from anyone who has half a clue have to be sent to the brass at this company and the ones they are auditing on behalf of before someone thinks "holy shit our entire reputation and business is being flushed down the toiler on a daily basis?"

It just doesn't pass the smell test for me. I don't know what it is, but something is missing from this story.

emp_• 15 years ago

Some programmer in AZ told me a couple days ago to in order to search their user profile database(location, department etc), instead of changing his web service to accept some criteria, I should just use the GetAll() method and do it locally (a few thousand profiles), when presented with the logical use cases and the little "performance issue" he quit his job.

JacobAldridge• 15 years ago

When "I have been in this industry longer than anyone on that site" is a cornerstone of your defence, you've already lost. Also, I know the UK has really strict laws, but I doubt he'd be able to sue for "liable".

almost2• 15 years ago

Actually we do have ridicules libel laws here in the UK. If someone accuses you of libel the onus is on you to prove that you didn't.

rmc• 15 years ago

I think the point is that someone who can't spell libel correctly is not very scary.

VladRussian• 15 years ago

being that ignorant and having important hi-tech industry job - he's already won.

arethuza3• 15 years ago

Nitpick: there are no such things as "UK libel laws" - England and Wales have one system, Scotland has a completely different set of laws.

Tyrannosaurs4• 15 years ago

This is true but the distinction is pretty minimal. Scots judges have traditionally followed the English lead seeing no sense in having different interpretations North and South of the border for the same story in potentially the same publication.

About the only real difference when it comes to defence is that up here you can defend something based on it being made in the heat of an argument, and that the person claiming defamation has to be able to show harm (though not necessarily financial).

Terretta2• 15 years ago

I think grandparent was chuckling at suing for "liable" not "libel".

dredmorbius2• 15 years ago

It's a flat lie as well.

He doesn't know, and can't know, everyone commenting to HN. At best hes fabricating. I was going to top post that but checked first to see if anyone had surfaced that line.

The auditor is an idiot and feels cornered.

Also: "I'm going to assume you do not have PCI installed on your servers".

PCI is an auditing standard. Not something "you have installed on your servers".

And I guess I'm getting too far ahead of myself, because the OP comments on this in his serverfault posting.

Classic! "PCI SSC have responded and are investigating him and the company. "

I'd say samarudge did a bang-on job here.

jhamburger• 15 years ago

He should have explained that the servers don't have any more PCI slots available.

keithpeter• 15 years ago

As I live and work in Birmingham, UK, I hope this is all an elaborate hoax.

nagrom• 15 years ago

I really hope you're not a security auditor? ;-)

d4nt• 15 years ago

Me too, I'm frantically googling so I can get the name of the company and add it to my "NEVER Take a Job At ..." list.

EDIT: Ah, think I've found them.

yaix• 15 years ago

The auditor was actually serious. Wow. I really thought he just wanted to check the reaction of the admin, to see if he'd actually hand over sensitive stuff.

astrodust• 15 years ago

The auditor has a hugely inflated ego, something that might be a sign you're dealing with a narcissist. It's a pretty huge claim to make that you've "been in the industry longer" than anyone else, but that's the sort of thing you'd say when you're that kind of person.

Everything they said is surely made up, and if you challenge them on their facts, they'll attack you in return.

cstross• 15 years ago

Yup. Sounds like a fairly classic case of workplace sociopathy -- the sociopath who gets promoted because they tell lies and bully the folks below them into obedience. (Not the kind of -- much rarer -- sociopath who is violent or robs banks, but still a royal pain in the ass to run across in a business context because any attempt you make to deal with them technically will result in manipulative social retaliation rather than "oh, my bad".)

antihero• 15 years ago

If it's in the UK they may be liable under the Data Protection Act, too.

sunchild• 15 years ago

I like the auditor's take on this:

"I see no data protection issues for these requests, data protection only applies to consumers not businesses so there should be no issues with this information."

The Data Protection Act applies to individuals within the EEA trusted circle nations, full stop. Whether or not the information being requested requires individual consent under the DPA is a different point altogether.

marcamillion• 15 years ago

At first, I thought that this was a bogus post...but it seems to be real - or this guy is keeping up with the story.

jarin• 15 years ago

Incompetent people in the security field really need to be called out like this.

Incompetent developers generally only hurt the company; incompetent security professionals hurt every single customer as well.

Auguste• 15 years ago

That security auditor could give a lot of the guys featured on The Daily WTF a good run for their money.

_b8r02• 15 years ago

A colleague of mine once had to stand one foot on top of the other and chew his own lip when an SI's "security expert" introduced himself as an 'old-school CISSP' just to stop laughing out loud at him.

There are many idiots in the information security industry (I should know, I are one) - we're doing our best to get rid, but more keep showing up.

__rkaup__• 15 years ago

Can you explain? I have no idea what a CISSP is.

_b8r02• 15 years ago

It's full name is the Certified Information Systems Security Professional. There's a good writeup of the problems with CISSP here:

https://infosecisland.com/blogview/15450-My-Canons-on-ISC-Et...

and here:

http://erratasec.blogspot.com/2011/07/ethical-problems-of-ci...

It's often described as 'a mile wide and an inch deep'. However, it's not really the example of broad security knowledge it sets out to be and is considered a joke certification in my niche (technical security).

Confusion2• 15 years ago

What's interesting is that the PCI standard seems to be unclear in this respect. He quotes from the standard:

  8.4 Render all passwords unreadable during transmission
  and storage on all system components using strong 
  cryptography.

This seems to leave room for passwords to be encrypted instead of hashed. I'd even say it suggests they should be encrypted instead of hashed, by not distinguishing between 'during transmission' and 'during storage'.

At the very least, quoting this isn't going to convince someone that passwords should not be decryptable.

Terretta2• 15 years ago

It's not unclear, and you're right. It has to be encrypted on the wire and in storage. This paragraph does not say you must hash, or must not be able to get the plaintext passwords back.

pyre2• 15 years ago

That may be, but even if PCI doesn't require you to have the passwords unrecoverable, I'm pretty sure that transferring all of them in bulk to someone else via email should violate some part of PCI. Even if that person is an auditor. The potential for abuse is too high.

dkokelley2• 15 years ago

The ambiguity lies in the word 'unreadable'. The key phrase is 'unreadable... using strong cryptography'. Can strong cryptography be reversed by decryption, or is strong cryptography a non-reversible hash?

hermannj314• 15 years ago

From the perspective portrayed in this article, the auditor seems misinformed about fundamentals in his industry and his response to being called on this seemed superficial and borderline childish.

It must be difficult to be ridiculed in a public form of your own profession. Not to mention being called stupid and ignorant for misunderstanding something. I hope I always have the humility to admit when I'm wrong, but also have the patience and understanding when other people don't.

motters• 15 years ago

Argument from authority. Nice try.

16s2• 15 years ago

Quite a few managers and auditors really don't understand the difference between a password hash and a password.

I expect the auditor was asking for password hashes, although he was using the phrase "plaintext passwords". Who knows, but that part of the story may just be a wording misunderstanding.

Not everyone speaks geek, and it's important to know when you're talking to someone who does not ;)

Edit: Not sure why this is being down voted as it is a true statement. I've had to explain what a password hash is on several occasions. And even after that, there was still some misunderstanding/confusion.

dpark• 15 years ago

The auditor specifically said "plaintext". He's clearly a moron, but there's no evidence that he somehow thinks plaintext and hashed are the same thing. He specifically said that the passwords should be stored in a "recoverable format for later use". He wants plaintext.

sdkmvx3• 15 years ago

There's still the question of why he would need the password hashes. Assuming he wanted the plaintext passwords to see if they are 'complex' and 'strong,' he would have a hard time telling that from the hashes.

5f4dcc3b5aa765d61d8327deb882cf99 and 05b28d17a7b6e7024b6e5d8cc43a8bf7: Which is a dictionary word and which is a string of punctuation? (I didn't salt :))

16s2• 15 years ago

Please. 16Crack broke these in less than 5 seconds. Plain md5.

05b28d17a7b6e7024b6e5d8cc43a8bf7 = !@#$%^&*()

5f4dcc3b5aa765d61d8327deb882cf99 = password

MostAwesomeDude• 15 years ago

John says the first one is "password", in under a second. I'll wait for a few hours to see if I can get the second one speedily. (By the way, this is why you shouldn't use MD5!)

MartinCron• 15 years ago

You're being voted down (not by me, mind you) as it can be interpreted as a defense of the indefensible.

Even with the charitable interpretation of "this guy doesn't know what plaintext means", the overall conclusion "this guy doesn't know what he's doing and is downright dangerous" still stands.

ceejayoz• 15 years ago

> I've had to explain what a password hash is on several occasions.

To security auditors? Who then told you you were wrong and that you should install PCI?

codeglomeration• 15 years ago

This sounds more like social engineering to me. My first thought was this was a hacker who took control of an email address from the security firm, and just tried to exploit the weakest link in order to get plaintext passwords.

blahblahblah• 15 years ago

Apparently, neither of these guys paid attention in high school civics class. Slander involves oral, not written, communication. Libel (not "liable") is the term for a tort involving false and damaging written communication.

techiferous• 15 years ago

"any inventive suggestions for how to troll him [the security auditor] a bit?"

Nothing productive could come of that. This situation is not for your entertainment. Just move along...

dougws• 15 years ago

I haven't been in the industry that long, but I've encountered a few "security professionals"--auditors, penetration testers, etc. All of them have been totally incompetent; they could tell you the definition of, say, a SQL injection attack but had no idea how to really analyze a system. On the other hand, all of the great programmers I've met have had a really good grasp of security. I'm starting to think that if you don't write code, you're not qualified to audit it.

diminish• 15 years ago

Dreaming of a world without passwords... Any ideas?

AppSec• 15 years ago

The problem with not having passwords is that it usually requires an authority to distribute keys (and not retain the initialization parameters for that key, cough RSA cough). And that could potentially require a third party having access to information a lot of people don't want. Or trusting the government to generate them -- which opens up another can of worms.

Things like OAuth and/or federated login still rely on a password at some level.

Pick your poison (personally, I wouldn't mind using an RSA Soft Token type technology with federated access requiring token + pin, but that's just me).

Auditor's response to "Our security auditor is an idiot" (Update 3)

Related Stories