News for hackers. Stuff that matters.
Re:Goodbye Auth0 by sokoloff on Thursday February 15, 2024 @07:39AM (#39381960)
At my second job, the company terminated an employee for poor performance and intended to let them stay on a short term to wrap things up and then start their severance. The first evening (or maybe the first Friday evening), that dev stayed late in the office and deleted the source trees from as many machines as he could get access to (this was 1996, so most machines didn't have logins) and destroyed the hard drive on the revision control server.

That experience (and the amount of loss and wasted time in reconstructing as best we could) heavily colored my view of the risk-reward ratio of letting terminated employees have continued access to premises and systems.

If I have any doubts about the future behavior of someone who just received very shocking, disorienting, and angering news, it is my job to protect the company and other employees much more than it is to allow the terminated employee continued access.

Re:Goodbye Auth0 by madsbuch on Thursday February 15, 2024 @07:50AM (#39382052)
Given that this is the US, he was probably sued and is still in prison.

Also, this is an insanely childish way to act – again to the original commenter. It it seems like there is a difference in US an EU culture here.

Re:Goodbye Auth0 by dylan604 on Thursday February 15, 2024 @10:20AM (#39383711)
> Given that this is the US, he was probably sued and is still in prison.

Like most things in life, it depends. You'd have to get a prosecutor to agree to accepting the case to bring charges against the individual. They'd have to decide if there was enough evidence, they'd have to decide if they thought they could convince a judge/jury, then they'd have to decide if it was even worth their time. In 1996, that might have been a more difficult thing to do than today.

> Also, this is an insanely childish way to act

Yeah? And? So? Are you attempting to say that no non-American has ever acted irrationally or childish? I have a few history books that would disagree

Re:Goodbye Auth0 by michaelcampbell on Thursday February 15, 2024 @10:34AM (#39383913)
> Also, this is an insanely childish way to act – again to the original commenter. It it seems like there is a difference in US an EU culture here.

It is, but safety protocols are put in for the extreme unexpected case. "Regulations are written in blood" and all that.

Not all Americans are childish any more than no EU citizens are.

Re:Goodbye Auth0 by supriyo-biswas on Thursday February 15, 2024 @07:46AM (#39382028)
Also see the case of Shannon You[1] where the person in question leaked the trade secrets for BPA production used in soft drink cans for being fired.

[1] https://www.justice.gov/usao-edtn/pr/phd-chemist-sentenced-1...

Re:Goodbye Auth0 by anonexpat on Thursday February 15, 2024 @08:20AM (#39382329)
You’s case was deliberate corporate espionage, not a disgruntled former employee.
Re:Goodbye Auth0 by Draiken on Thursday February 15, 2024 @08:30AM (#39382438)
So because the company hired a criminal sociopath, every other person laid off until the end of times must be treated the same way? Certainly there are better ways to handle even this crazy scenario you mentioned.

That feels so inhumane to me. If you don't see your employees as humans, instead as mere resources and, as soon as they are laid off, threats, then we can say it makes sense.

Re:Goodbye Auth0 by coredog64 on Thursday February 15, 2024 @09:54AM (#39383351)
I had a coworker who wasn’t even laid off and did something along these lines* on his last day because he felt hard done by.

*Deleted the configuration from the core network switch.

Re:Goodbye Auth0 by dylan604 on Thursday February 15, 2024 @10:26AM (#39383793)
So just a typical AWS us-east-1 employee then on a random day?
Re:Goodbye Auth0 by ianhawes on Thursday February 15, 2024 @09:09AM (#39382878)
Similar things have happened in my ~12 year career which leads me to believe it is not as uncommon as your comment would portray it.

The first instance I can recall, a developer was terminated and his access was revoked. He goes home, waits until midnight, then tries logging into as many systems as he can. He apparently had saved a WordPress password on his Google Drive. He logs into WordPress and defaces a bunch of pages on the corporate website. FWIW he was one of my reports and he did not come off as a sociopath or unstable and his actions surprised me.

Second instance at a different startup, a marketing guy is terminated but was allowed to hang out at the office for a bit (for some reason management decided to fire him on a Thursday morning knowing he carpooled with several other employees). I felt bad so I took him out to lunch. At lunch he tells me he had a feeling he was about to be fired so he dumped the ~400K+ database of emails in our HubSpot account to sell to a competitor. I told him that was easily the dumbest idea he's ever had. I text the CEO from the bathroom to warn him. He's trespassed from the building upon our return. Oh, and he suspected I tipped them off and so he keyed my car.

Third instance at my own company, I terminated a contractor and removed their access to all services immediately. They attempt to run a series of reports on vendors, contractors, and other sensitive data from the admin UI without realizing their session was invalidated. I get the error notifications and add more granular permissions to the admin panel.

Is it inhumane? No. Is it rude? Yes. I think you have no choice _but_ to treat these people as humans. Humans do human things and act out for a variety of reasons and you have to expect that. Are they inherently bad people? No.

Re:Goodbye Auth0 by Draiken on Thursday February 15, 2024 @09:47AM (#39383274)
I can definitely understand that assuming everyone is not a sociopath is very naive. But the reason I say this is inhumane is not about the security implications.

There's a whole plethora of issues around layoffs that are often ignored. I recall looking at Slack's people list constantly to see which accounts were suddenly marked as "deactivated". People I had great relationships with but never exchanged personal emails simply gone. That dread of "what the fuck is happening" and "am I next?" overcoming you. Some people scramble to create sheets with contact information from those who were laid off.

That's absolutely inhumane.

I survived 3 layoffs in the past few years and I can still distinctly remember the awful feeling each of those left me with. I can only imagine how much worse that is for those affected.

We can separate the security parts from the human parts. Companies choose not to do that, for whatever reason that I simply cannot understand. Especially companies with so called "human resources" should be extremely prepared for situations like this, to make sure everyone is actually treated well.

Recently we had that viral video of a person that recorded themselves getting fired with zero reasoning of why. That's the kind of shit that happens with these layoffs. Bad management at its worst.

In short, I agree with you with regards to security implications. But those can be solved with proper access controls and planning. What I don't agree with is everything else around it. Not once I have seen companies laying off people handle this in any manner that I would describe as humane.

We can do better, I don't know why we don't.

Re:Goodbye Auth0 by sokoloff on Thursday February 15, 2024 @09:50AM (#39383318)
> Especially companies with so called "human resources"

Never forget that "human" is an adjective in that phrase, not a noun. HR's duty and focus is on serving and protecting the company, not the employees.

Re:Goodbye Auth0 by dylan604 on Thursday February 15, 2024 @10:30AM (#39383857)
You don't have to be a sociopath or a criminal to be able to do harm to a company. There are some positions where clients loyal to the person rather than the company like sales or some form of producer/manager depending on the industry.

There are stories of sales teams going in and grabbing their rolodex (instantly dating the stories) so they could use the contacts where ever they land next. They could also reach out to the contacts to attempt to poison them towards the company, libel be damned.

Re:Goodbye Auth0 by rglullis on Thursday February 15, 2024 @08:35AM (#39382505)
Is that the lesson to learn here, really? An employee makes a stupid thing and the leadership didn't look into its security practices to avoid this type of attack?
Re:Goodbye Auth0 by ianhawes on Thursday February 15, 2024 @08:52AM (#39382682)
The lesson here is that once an employee or contractor is terminated, you remove all access to internal infrastructure. That's it. That is the lesson.
Re:Goodbye Auth0 by rglullis on Thursday February 15, 2024 @09:03AM (#39382797)
Then your company is still susceptible to being destroyed by any random employee.
Re:Goodbye Auth0 by dylan604 on Thursday February 15, 2024 @10:24AM (#39383768)
Potentially, yes. Someone could go nutty before being dismissed, and it just be Tuesday. That's why there's things we often refer to in this industry as backups. If it is just a software bit of mischief, you should be able to recover from that without too much down time. s/disgruntled employee/ransom ware/ and it's really no different.
Re:Goodbye Auth0 by makeitdouble on Thursday February 15, 2024 @09:16AM (#39382955)
Not "terminating" your employees and having meaningful conversations on how it goes after they know they're let go helps a lot.

That forces the employer to come up with actual explainations someone can digest, and gives the employee time to be rational and plan the pivot.

There will still be ugly stories, and preemptively removing accesses will be needed in some cases, but that's by far the exception and not the norm, and we usually know when that will be the case.

Re:Goodbye Auth0 by yjftsjthsd-h on Thursday February 15, 2024 @09:44AM (#39383250)
> and the leadership didn't look into its security practices to avoid this type of attack?

It sounds like they very much did, starting with physical security. Especially in that time period, physical access was probably the biggest component even.

Re:Goodbye Auth0 by osmano807 on Thursday February 15, 2024 @09:16AM (#39382950)
The lesson to learn is to entrench fail-deadly protocols in as much infrastructure as possible in case of termination.
Re:Goodbye Auth0 by rglullis on Thursday February 15, 2024 @09:32AM (#39383119)
> in case of termination

The lesson is that employees should only have access to the resources that they need to do their job at all times, and that there should be a fine-grained permission system to check if someone can read or read-write to all these resources.

Even when I am working on my projects, by myself, I use different accounts to access my services, depending on the role. At first it might seem crazy, but if you learned how to do this and you automate this process, it is a life-saver if you suddenly find yourself need quick help from some contractor or if you want to give a backup key to a trusted friend as a way to say "here is what you need to do in case something happens to me".

Re:Goodbye Auth0 by smugglerFlynn on Thursday February 15, 2024 @02:09PM (#39387032)
If your crazy ex steals your watch on the way out, does it mean all new people you meet will get a frisk search at the end of each date?

That’s not how trust works, regardless of potential consequences.

Re:Goodbye Auth0 by sokoloff on Thursday February 15, 2024 @03:16PM (#39388137)
No, but you probably do get your key back immediately after your next breakup.