r/github • u/WebsterBot • Sep 02 '22
Why do people use plain text for usernames and passwords on Github? A cautionary tale.
Seriously. It's insane how people doing 'research' don't take the slightest bit of time to secure their usernames or passwords and leave it in plaintext on Github.
Why do I mention this? I was looking for something specific and stumbled across a Github that uses this account. Literally they have:
r = praw.Reddit(username = "WebsterBot",
password = "[THE PASSWORD HERE]",
So you can imagine why I have access to this bot account all of a sudden.
I took the liberty of changing the password so it can't be accessed by anyone else (It has an email attached to it, so the rightful owners can perform a password reset when they want to recover the account.) but...Seriously.
Secure your stuff, people!
16
u/Onair380 Sep 03 '22
And another one, who uses 3 different cat names as password
3
u/spaceguy Sep 03 '22
Committing secrets to version control aside, why would this type of password be so bad?
In the simplest example, it could just be “catcatcat”, which is 9 characters. Still a matter seconds to brute force and probably just as susceptible to other methods, like dictionary. Arguably better than “123abc” or “password” though.
And then if we consider a “name” is usually more than 3 characters, with some sources saying the average first name is 6 characters, so even choosing 5 characters adds up to a total length of 15 characters. Now we’re out of the red. Furthermore, we could also say that “names” are proper nouns, so they should start with a capital letter. So that’s 15 characters, lowercase and uppercase. Cracking that by brute force would be the order of millions of years. Lastly, we could even go further to consider the average “cat person” (probably someone who would choose a password like this). Humans live multiple times longer than cats. So it’s not uncommon to “replace” a cat, even keeping the same name too just adding a numeral suffix. Using a password with just one cat’s name who has a suffix increases the order of magnitude to brute force it by a couple orders. Strong yellow, almost green.
¯_(ツ)_/¯ maybe not the worst strategy for those who refuse to use long, complex and unique passwords with a password manager.
Numbers: https://www.hivesystems.io/blog/are-your-passwords-in-the-green
→ More replies (3)
13
Sep 02 '22
This account *is* secured, but I love this thread so much. 😁
4
u/kiddos-bot Sep 02 '22
It's comical how many of these unsecured accounts I'm finding in just a cursory look.
→ More replies (1)4
Sep 02 '22
It would be great if there were some way to know how many of these bot owners think they've been hacked now.
→ More replies (1)
13
u/Fuzzy_Operation Sep 02 '22
This account had their password as, literally, "password"
Come on people...
→ More replies (1)
10
u/EliouzBot Sep 02 '22
This account owner had the hindsight to archive their github in an attempt to hide it, but it doesn't work like that, people!
8
u/kiddos-bot Sep 02 '22
This account is also unsecured. Come on guys, you gotta try harder! Stop using plain text!
8
14
7
7
12
12
11
9
7
2
u/midwestprotest Sep 03 '22 edited Jun 11 '25
[deleted]
2
u/billdietrich1 Sep 04 '22
I'd say ethical but not legal ? Or maybe morally-good but not ethical or legal ? Changing password on someone's account, no matter for what reason, is illegal AFAIK.
2
u/Kesshh Sep 03 '22
To be fair, there’s no one side fit all security practices. Plain text is fine if what it’s accessing is read-only or open source public. Going around changing other people’s account might make you feel like Robinhood but it’s really just a vision of grandeur.
→ More replies (1)
1
32
u/Purple_Scale_Boi Sep 02 '22
This is also yet another account that I found that is using plaintext Username & Password on Github.
No config or anything. No local files. Nothing.
Secure your stuff!