News for hackers. Stuff that matters.
Re:Goodbye Auth0 by progbits on Thursday February 15, 2024 @06:59AM (#39381665)
You trusted them with that access yesterday, and they are not being fired for cause (eg. stealing company secrets), so why don't you trust them today?

This sort of thing only really happens in US companies (see lots of other comments in this thread on this), and maybe that should be a clue this isn't "security practice".

Re:Goodbye Auth0 by marcinzm on Thursday February 15, 2024 @07:37AM (#39381949)
> only really happens in US companies (see lots of other comments in this thread on this)

That's not what the comments say.

Re:Goodbye Auth0 by rad_gruchalski on Thursday February 15, 2024 @07:07AM (#39381714)
> so why don't you trust them today

Because they heard about being laid off this morning and who knows what goes through the mind of a laid off person.

Re:Goodbye Auth0 by sokoloff on Thursday February 15, 2024 @08:19AM (#39382324)
Exactly this. The company just subjected the individual to an enormous amount of stress that didn't exist yesterday coupled with the fact that the long-term payoff to them of "don't act like a jackass at work" has just changed a lot.
Re:Goodbye Auth0 by rad_gruchalski on Thursday February 15, 2024 @10:57AM (#39384260)
Yes. That’s the unfortunate part of being laid off. So to protect the individual from himself and the company from the individual it might be actually better to just lock people out.

Funnily, nobody has such empathy towards a company when the employee lays the company off. Then everyone is like „suck it up company, suck it up boss”.

Re:Goodbye Auth0 by groby_b on Thursday February 15, 2024 @04:48PM (#39389488)
I'm fairly certain when an employee lays the company off, they do them the same courtesy and immediately lock them out from their life as well.

Also, if you'd like more empathy, in both directions, there is nothing in the US _preventing_ you from extending an employment contract with a well-defined layoff & severance process. Most companies choose not to do so, to preserve options. Well, you made your at-will bed, you get to lie in it.

If you're a manager caught in the middle: Yep. It sucks. It's also predictably part of your job, so make sure you're compensated accordingly. (You can't manage for an extended period without being forced to lay off somebody at some point. ZIRP stretched that period, a lot. It's still a thing that's part of the job)

Re:Goodbye Auth0 by morgante on Thursday February 15, 2024 @07:06AM (#39381709)
Fired employees are much more likely to do something malicious, either by sabotaging systems or stealing proprietary data. The incentives are totally different.
Re:Goodbye Auth0 by nucleardog on Thursday February 15, 2024 @08:55AM (#39382716)
> You trusted them with that access yesterday, and they are not being fired for cause (eg. stealing company secrets), so why don't you trust them today?

Yesterday, behaving in a manner that would result in your continued employment had clear, short term incentives like receiving further income. The company had leverage in that if you were to behave inappropriately they could terminate your employment and take away that income.

Today, the company has terminated your employment and taken away that income. The only reasons to not be malicious are long term consequences (future employment prospects, criminal charges, etc) and personal values.

People in general are notoriously bad at aligning their actions with long term incentives or consequences (especially consequences). You're testing this out in this employee for the first time in a situation where they're under much higher anxiety and stress than normal and you no longer have any real leverage over them.

I'd imagine the difference in the US has more to do with the short notice period and lack of social safety net making being terminated a much more impactful event for the employee.

Re:Goodbye Auth0 by scott_w on Thursday February 15, 2024 @05:31PM (#39390134)
In addition to what others said, there’s also a compliance aspect.

Even if 99% of laid off staff will react fairly and reasonably, it only takes a few to do serious damage, potentially to your customers.

Even on a small scale, those laid off can cause some harm: “losing” things, getting extremely enthusiastic with decommissioning equipment, or even filling the company cars with fuel right before giving them back to the hire company.