Ask HN: Coworker is logging plaintext passwords
I'm of the opinion that we should never store plaintext passwords anywhere no matter what, he is logging them before hashing them. Is this common and or acceptable?
Important details: whose passwords are being logged? His own? Other co-workers? Management? Clients? Is management or anyone else for that matter aware of this? How are they being logged? As part of an application or some sort of active traffic monitoring?
Context is king, as in all things - this could be anything from a junior dev fresh out of college with some bad habits that he'll need to be coaxed out of, to a malicious employee logging client passwords to keep them on hand when he leaves so that he can sell to the highest bidder on some Russian cracker forum. It's probably not kosher no matter what the context is, but it's hard to offer advice on how to react to this without knowing more details.