Nissan code leaked after bitbucket repo set-up with defaults admin/admin

Re:Nissan code leaked after bitbucket repo set-up with defau... by tiborsaas on Thursday January 07, 2021 @11:53AM (#25673488)

You can try as hard as you want, but users will always find a way to bypass your precautions and shoot themselves in the foot.

There's also a danger that if you try to do this, then your product turns into a UX nightmare.

[ Parent | on HN ]

Re:Nissan code leaked after bitbucket repo set-up with defau... by orev on Thursday January 07, 2021 @12:38PM (#25674293)

Defaults matter. There’s a huge difference between starting an account with a complex password and then the user intentionally weakens it, vs starting with a weak password with a note saying “pretty please change it”. It’s obvious that some set of users will not change it, so it’s better to start in a default secure state than an insecure one.

And yes, sometimes security and UX conflict, and users just need to deal with it.

[ Parent | on HN ]

Re:Nissan code leaked after bitbucket repo set-up with defau... by tracker1 on Thursday January 07, 2021 @02:08PM (#25675696)

I tend to make a default passphrase of "Please change me." and require a password change on first login.

[ Parent | on HN ]

Re:Nissan code leaked after bitbucket repo set-up with defau... by gabereiser on Thursday January 07, 2021 @01:50PM (#25675400)

Yes but in this case there was no auth and the user setup admin/admin. This was a human.

[ Parent | on HN ]