4

I worked in a heavily regulated industry and a company that is resistant to change. We recently just got Slack and everyone on our engineering team was getting used to it.

A few jokes were made with the emoticons and one thing led to another and someone ended up saying something that Slack is secure enough to encrypt credentials by default. Several others appeared to be typing in their passwords and it was censoring it.

So for some strange reason, I decided to type my password in the chat to see if it actually was true.

I know it was stupid, but I apologize and was really curious. Nothing came out of it for the next few hours, but suddenly I get a call from the IT security team frantically mumbling something but I was able to calm him down and I sorta threw my team under the bus.

They now have to undergo a weeks worth of “learning to use Slack” and sexual harassment training (I don’t know why this was included) because of me. I feel extremely dumb and I apologize for anyone who has to go through additional training because of my actions.

Considering these types of things eventually happen to people, as embarrassing as it is, is there anything I can do to prevent these sorts of accidents?

|improve this question
  • 5
    There is always a delete option in slack and passwords can be changed too – Sara Nov 22 '19 at 6:02
  • 5
    Ouch. I don't mean to sound overly harsh but it sounds like a common sense thing to me. It sounds to me that you were a bit gullable in this instance unfortunately. You might need to take your colleagues assertions with a grain of salt in the future. – ChrisFNZ Nov 22 '19 at 6:16
  • 17
    It's an old old practical joke: bash.org/?244321 – Geoffrey Brent Nov 22 '19 at 8:49
  • 7
    With all due respect to your coworkers, it does seem to me like they legitimately need training in appropriate use of a company-provided messaging tool. Clearly, such tools are not intended to be used for practical jokes that have serious security implications. Don't feel guilty for being a victim. – dwizum Nov 22 '19 at 15:11
  • 6
    @dwizum More precisely, the sort of fooling around the coworkers were doing actually provoked the security-compromising event: they persuaded another employee to reveal their password. Some places have a fun-is-fun attitude, but this went beyond fun and caused an actual problem. The OP made a mistake, and should not ignore that (and seem not to be ignoring it, which is good), but the coworkers have earned their mandatory training and the OP need not feel bad about that. – Upper_Case Nov 22 '19 at 16:23
6

If I understood your question correctly – somebody (not you), was joking around on Slack channel about the fact that they can enter passwords. And then you compromised your password.

Now I don’t know any details of how did you threw them under the bus, but as long as you stick to the facts, you did the right thing to report the incident to information security. You should have been the one to report it, and for future reference – in some industries, you can be liable if you don’t report it as soon as possible. If you end up working for the government (or government-related projects), medical projects, financial and banking, energy, and so on. In future – always report anything that looks like a breach in information security, fraud, etc.

While your colleague might be annoyed at you at the moment – they do need extra hours of infosec training, and you probably saved their life, because they could get into serious trouble if they continue this pranks in future. Can’t make any comments on the sexual harassment tracing, but it shouldn’t hurt.

In future – if you have a suspicion that your password is compromised – change it, and report it immediately. If it looks like someone is fishing passwords in your organisation, whether knowingly or unknowingly – tell them to stop, and act in accordance with the Information Security Policy of your company. Ideally, ask them to report themselves, and handle it on their own with the InfoSec department, but it depends on the organisation and industry.

Considering these types of things eventually happen to people

I'm in this industry for more than 17 years, and I never heard of this before, not first hand, not second hand, not a friend, of a friend, of a friend. You are unfortunately the first one, and I think you guys got off extremely easy. I know might sound offensive, but I feel like I need to make it clear how serious this can be.

|improve this answer
  • 5
    Sexual harassment training for the team is probably a good idea too. Office pranksters often overstep that line. – Robin Bennett Nov 22 '19 at 12:20
  • Yes, thanks @JoeStrazzere – David Sergey Nov 22 '19 at 23:16
  • The sexual harassment training might be as a result of an unrelated incident that didn't involve OP as well. – notmySOaccount Nov 25 '19 at 0:57
  • Accusing the team of potential sexual harassment because of a bad practical joke is very far fetched, is it not? "Yeah I heard this guy typed his password in slack. Maybe he is a sexual predator too. You never know with these 'pranksters'." @RobinBennett – ig-dev Nov 26 '19 at 0:16
3

is there anything I can do to prevent these sorts of accidents?

Yes, retake the training session, as suggested, and try to stick to the learnings.

To add: However tempting it might be to do a silly thing using company resources and to try out new features which can potentially cause an InfoSec breach or a NDA violation, you should not do that. Most of the contracts / work agreements mention this clause:

Company resource is meant for company business only,

It's not for fun and exploring new things unrelated to work. Refrain from using company resources (including the company account information) as your personal one.

Oh, and change the password immediately, if you've not done that yet.

|improve this answer
  • I changed my Disney+ account along with anything else important to me just in case since I may use the same credentials after I got done speaking with the IT security people. Thanks for the reminder. – Jamie Fevor Nov 22 '19 at 6:06
  • 4
    Using the same password across multiple sites??!! Get a password manager & hang out on security.stackexchange.com – Mawg says reinstate Monica Nov 22 '19 at 6:36
3

My thought: the person asking people to type in their password is actually working for the company or passed it on to the security person. My company regularly sends out emails, phone calls, etc to get people to click on links or passwords. Once you do, it's training time. First few times, it's a simple landing page with explanation about clicking links and all that, but next time they're coming after your manager.

With that said, I think everyone on your team should have to take the test who was in that chat channel. You should retake the test as well and accept it as a lesson. Your team failed because they should have notified everyone not to type in their password and to block the person asking for it (even if it is seemingly a teammate). You failed because you should have known it as a trick, and not a really good one.

Most good systems will not even know what your password is. To even implement such a feature to block out your password would be a security flaw in itself. It would have to hash all your chat, compare it to the hash in the db, then determine what characters to block out in the text. All one has to do is carefully engineer a social scheme to ask common questions to figure out someone's password as their answer would be blanked out automatically. So next time you see an email or phone or message asking for anything related to security, do not answer it and report it asap. Just ask yourself: "Does this person really need to know that?"

|improve this answer
2

Considering these types of things eventually happen to people

No they don't, it was extremely unprofessional. Especially for engineers.

But nothing you can do now but suck it up. You've caused a bit of grief and the sexual harassment thing is probably thrown in as punishment.

So don't try and justify it or rationalise it as you did in your question. Learn your lesson, it was actually pretty cheap. I've seen people fired for letting their passwords out in high security environments. Chances are this is a tradeoff between someone getting hit real hard as an example and the team getting some training.

|improve this answer
0

To me there is some information lacking, to understand what exactly happened here. Some queries I am left with:

  • Why did IT Security call you? They had to find out somehow, but there are several ways to do so, all of which change the context a lot. E.g., possibly security personnel has access to the channel and saw these credentials. Possibly your team reported credentials floating around slack, or someone else with access to the channel. However it is also possible that someone logged into one of your company accounts using this information which may have been logged by IT Sec. While this would have been someone with access to the Slack channel - it is still very clearly a breach.
  • How were you able to calm down IT Sec? You said you did not understand what they were mumbling, yet you seem to have understood enough to calm them down and to assign blame. Therefore - what have they been saying?

  • Why the sexual harassment course? The only way I am able to come with an explanation for this, is if your gender or sexuality is different from the gender or sexuality of the majority of the engineering team. This could have led to the conclusion, that your colleagues provoked this joke at your (and ultimately their own) expense, because of your gender or sexuality, in which case the sexual harassment course is justified. However, going only off what I know from this post - your name is Jamie, afaik this is a male name in an English speaking country, yes? Engineer teams having a female majority are also more rare in the industry, simply due to the prevalence of male engineers, but still, this scenario might be a (however remote) possibility.

    Either way, I am trying to construct a way of how this situation could lead to a sexual harassment situation and you already see how contrived my example is - so again I am inclined to think there is information missing here.

One more thing with regard to the blame-game. The way I see this personally:

  • Are you a tech savvy person? Is it expected of you to be experienced with using technology? Are you a dev? A CTO even? If so, I would expect you to research the API you are using before typing in your credentials. You should understand very basic security concerns and you should be able to do research on your own - your fault.
  • Are you inexpert with tech? If on the other hand you are not to be expected to be well versed in questions such as IT security, doing your own research on APIs, working with tools belonging to most modern tech stacks and so on, e.g. if you handle the business side of things, maybe accounting or marketing, then my argument would be that your tech savvy engineer colleagues used this knowledge to play a joke on you. They knew, they as technology experts could use the experience you know they have, to convince you of something they know is false. If this is what happened - their fault.

Whether or not your superiors agree with my assessment I cannot say.

|improve this answer
  • Jamie is a unisex name. But regardless, I think the sexual harrassment training could be as a result of an unrelated incident not involving OP. OP says "I don’t know why this was included" so it's likely it doesn't have to do with OP or with this same incident. – notmySOaccount Nov 25 '19 at 4:19
  • Exactly, could be. You are making an assumption, I think there is simply information missing, maybe even not disclosed by OP intentionally. To put it differently, while such a joke in itself is not all that uncommon, all the surrounding aspects of this story seem strange to me – Mär Nov 25 '19 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.