I work for a startup where we have to frequently pitch to customers and investors. I'm the most senior developer in experience, but I did not want the lead role, so I could avoid most client meetings as I hate dealing with insane requests. My boss still brings me along anyway.
During pitches, they talk about how we are proactive about security because we know that users won't be. They then go into this story about how they "used [their] hashtable skills to create a frequency table of passwords and none of them looked very secure. "First of all, any decent junior developer can do a hashmap, so it is not the awesome skill they think it is and second, nobody should be able to see the passwords at all as passwords must be hashed and salted. I implemented that when I arrived, so the "password hashmap" can't be done anymore, but she keeps pretending like it was something done recently.
She has another anecdote about how "the software used to have a feature where our clients could just use SQL to do their data analysis, but security people (me) made them get rid of it." We developers call it SQL injection.
We are a startup that stores medical data and the CTO goes on about "world class security" (which we don't have, but I digress), so it alarms every technical person we pitch. You can visibly see the alarm in the eyes of the technical people. I have learned to stand in the back and mouth "I did not do that. I did not do that." The worst case was when one investor came to my LinkedIn a day later to yell at me for "trying to scam him with something out of PHP for Dummies."
Not one pitch has succeeded when she has used the anecdote and I have to deal with potential clients and investors asking me how the heck we can be so careless with medical data.
My boss doesn't believe that not hashing passwords is a serious issue that would cause investors to skip a company.
I've told my boss to stop as knowing user passwords indicates that our security is not anywhere near world class and she says the story "makes us seem scrappy and homey." Normally I would just leave it be as we have sufficient contracts to keep my job so further growth is not my problem, but I'm concerned for my own reputation.
Can you think of any other way to get my boss to stop this?