- Feature Articles
- CodeSOD
- Error'd
- Forums
-
Other Articles
- Random Article
- Other Series
- Alex's Soapbox
- Announcements
- Best of…
- Best of Email
- Best of the Sidebar
- Bring Your Own Code
- Coded Smorgasbord
- Mandatory Fun Day
- Off Topic
- Representative Line
- News Roundup
- Editor's Soapbox
- Software on the Rocks
- Souvenir Potpourri
- Sponsor Post
- Tales from the Interview
- The Daily WTF: Live
- Virtudyne
Admin
Yeah, major WTF. You shouldn't be eating crumbly food over your webservers, and if you do, at least have the courtesy to clean up after yourself.
Admin
Mark, just for future reference, the term "rubber-stamping" refers to a process whereby some entity approves something solely because some other, more powerful entity orders that it be done, without actually debating or considering its merits.
If this Software Advisory Committee were actually "responsible for rubber stamping any and all new production application installations", that would mean that they are automatically approving all application installations without review, and Michael P. would have little to be tense about.
Admin
Admin
Nonsense, if you think that's a lot of work then that's TRWTF. Just add a number of votes column to the database, a link to vote up a post (maybe one to vote down too) and have a trigger that when the number of up votes passes a threshold change the comment to featured. It doesn't even need testing since the need to submit messages three times already shows that Alex is pretty fault tolerant.
Admin
When I first started at college (many years ago) one of our first classes (that everybody in the program had to attend) was your basic introduction to computers (it wasn't a CS program). Basic stuff, this is a mouse, this is a keyboard. Anyway, we got as far as demonstrating how to sign into the university network and the lecturer asked for a volunteer. This one kid gets up, types in his username, which for some reason the computer didn't take, it asked for his username again. He didn't notice and when right ahead and put his password in, unmasked, projected on a screen for everybody to see. His password, "bigboy". Ruined the kids college career.
Admin
When the devil wanted that nothing should happen, he assigned the first committee.
Admin
Way to go on a mechanism for filtering stupidity.
TDWTF articles are like roses in the desert. Most of them are withered, but it's worth checking in just in case there's a gorgeous red bloom. (Not, sadly, in this case.)
It's a toss-up whether they need a better spell-checker or more manure. What they don't need is an ignorant voting system.
Admin
I bet it was something like
stares at screen in shock Puts on his arrogant I-know-everything-better-than-you expression "See, the password is hidden behind a link as I told you, [b]you fool[/]!"
Admin
Oh S.Y.K. I can always rely on you to be a rascal.
How bout this then: the committee (not-Greg) rubber stamps, but Greg, the manager and dude on the panel, is completely nuts. Ok?
Admin
Now, sir. THAT is a WTF. This article is purely lame and utterly written in the worst of grammatically incorrect structures.
Admin
So, uh... what's wrong with emailing the user their (ramdomly generated) reset password? From these comments I can see that this is generally considered bad practice, but I don't understand why it's so egregious.
Admin
Trying to read this one about gave me an aneurysm. It's almost as if the text of several different WTFs were randomly shuffled together. At first I was thinking it was a personnel review. Then it's a product review. Then it's a rant about some PHB. Then it jumps around between them before just abruptly ending.
Admin
Admin
TRWTF is that no one here can imagine code like this:
(Note: this is not production quality code which is entirely beside the point)
Admin
" ... - anything to get the stupid the development manager was spouting out of his mouth."
holy fracture phrases batman.
Admin
They're BOTH morons. Emailing a plain text password is probably safer, to be honest, although neither should be done. Generally speaking, I would imagine that most stuff coming into my email browser are NOT being sniffed. I still wouldn't want a plain text password emailed to me... but come on...
WORSE is a BANK sending a LINK that says CLICK HERE. That's right, TRAIN YOUR CUSTOMERS that it's a good idea. Because nobody impersonates a bank message and asks you to click on a link.
The real way to do this is to have a password reset form on the page that asks several bits of information (no, not your mother's maiden name which is public knowledge if you're willing to spend about $5 and 5 minutes on one of a hundred websites that archive public documents). Maybe the last 4 of your social and your account number, for example.
Admin
Okay, here's an improved version:
Michael P. was feeling pretty tense – and really, who could blame him? Today was no ordinary day. He was in the hot seat, presenting to the Software Advisory Committee - a multi-disciplinary group responsible for approving any and all new production application installations at MegaBank. If his application received their blessing, he would no longer be among the ranks of MegaBank’s junior developers. Instead, he would be shoulder-to-shoulder with the senior developers in the company. His word would have weight, people would come to him for advice. But all this could be demolished if he did not gain the thumbs-up of the Committee, which was headed up by Michael’s manager, Greg.
To fully grasp what Greg is like, imagine you have two bosses who work in alternating schedules, and each despises the decisions that the other makes. Now imagine those two bosses are the same person – this was the committee of Greg. In these meetings, Greg would incredulously ask why the developers would dare even suggesting that they may try to implement the features he had told them to implement several weeks ago. Michael’s session with the committee wasn’t going much better. However, if Michael had even the remotest of hopes in getting his first new application installed, he was going to have to play this one cool.
"Why can't we give the user their password in an e-mail?" Greg asked. "I go on websites all the time and they always tell me my password when I forget it!". For a moment, Michael considered asking "Which websites?" He also considered burying his face in his hands, or perhaps banging his forehead against the desk repeatedly – anything to forget the stupidity the development manager was spouting.
“The only thing that sending a user a gobbledygook URL instead their actual password accomplishes is proving that we are a company of sloppy and inexperienced coders," Greg exclaimed. "In the end you’ll be turning customers away from us, balking at our utter lack of professionalism!” Michael tried to make his case that the email that went out did not show a full URL, but rather was behind a link labeled “Click Here", and that the process of picking out a new password was actually quite user-friendly.
However, there was no chance to begin explaining. Greg lowered the brim of his glasses further down his nose, and interrupted with, “The standard way of recovering passwords is to send a user their password, not to hide it behind a link! Here, let me show you how Google does things. Pay attention, and please, keep an open mind.” As Greg surfed to Gmail to go about resetting his password, Michael could barely watch – the embarrassment was too great. He thought that he had considered every angle, yet here he was about to be proven a fool. However...
In the email that Greg had received, Gmail had sent a link enabling him to set a new password.
Admin
Carelessness used to cause lives. Now: it's more sort of sorrow and disinterest, really.
Admin
For the win ^^
Admin
I love the stories, and this one was a great one because I can relate. But I have to ask the editor to please check for typos. It's getting bad as of late.
Admin
Why not? Just because they ask for my mother's maiden name when I setup that account (for the security questions) does not mean that my mother's maiden name is what I entered.
The trick with these security questions is to answer them INCORRECTLY, but with an incorrect answer that you'll remember. This way, if someone actually gets hold of your CORRECT "first pet's name" or "mother's maiden name" or whatever, the information that they have is wrong...
Admin
That's easy... you simply turn the bowl of soup upside-down to match the orientation of the spoon. Duh.
Admin
Agreed -- this was one of the worst-written articles I've seen in a while.
Admin
I'm thinking the correct answer is "that's good enough for google, but we're a bank - in reality, letting a user reset their password via email seems to be a hideously insecure system that ought to open us up to a lawsuit the moment someone gets their account hijacked and all their money stolen."
"Convienient", as far as I can tell, is often the opposite of "secure".
Of course, users actually like convienence and security and will pick the bank that agrees that convienence and security are synonyms even if its not technically true.
In reality, of course, the banks are run by superior intellects who would never foolishly put short term needs ahead of long term security, and therefore our passwords, just like the economy, are in safe hands.
Still, the real WTF is getting as far as the presentation without having run it past your boss to see if there's anything you've missed. Also, understanding the intellect and the desires of the committee is often important. Even if you work for an idiot, you need to account for that, and make sure your own ass is covered when any lawsuits hit.
Admin
But only a great fool would think to tell the truth. I am not a great fool, so I can clearly not choose the correct answers. But you must have known that -- in fact, you'd count on it -- so I can clearly not choose the false answers...
Admin
The great thing about st-, er, false answers is that there's so many to choose from!
Captcha: Saluto, and good bye!
Admin
Clearly you have a dizzying intellect.
Admin
Hahah, wow, the bigboy story is classic. He will never live that one down.
Admin
Admin
Admin
Admin
Admin
You guys do realize that this is the "Daily" WTF, not the weekly, monthly, yearly, or decade-ly.
When you have to write and post a story every business day out of a selection that you have no control over, you can't constantly print amazingly funny and clever events.
I come to this site expecting a mild chuckle and an enjoyable story. I'm rarely disappointed, and I occasionally find something truly hilarious.
If you come here expecting some super incredible top-quality WTF every day, well, get used to disappointment (Ironically, I just unintentionally quoted the same movie that many of the posts above me have). Alex doesn't get one of those every day. When he does get one, he'll often reprint it every year or so to make sure that everybody gets to read it (and of course, he gets criticized for that, too).
Anyway, keep up the good work
Admin
The real wtf: ``did not show a full URL but rather it wassafely behind a link labeled “Click Here”''
Yeah, that's secure!
Admin
SSNs and Bank Account numbers just as insecure as Mother's maiden name. Just because something is a number doesn't make it secure.
Repeat after me, shared secret authentication requires secrets.
Admin
I don't like this idea either. Everyone always says you should set your password to something that isn't personally identifiable to you and here we are, a system which basically requires you to set a second password that gives you just as much access as the main one (since if you know it, you can reset the main password to whatever you like) but is LESS secure.
And you can't just go by the "answer the question incorrectly" rule either because then what if you forget your answer as well?
The only solution as far as I can see is to send out password reset links, and have a way to tell them apart from phishing emails. Or just have users that aren't braindead enough not to be able to tell the difference. If it's good enough for Google it's good enough for me.
Admin
Admin
I kept waiting and waiting for the manager to say he was just kidding, but he never said it. Damn.
Admin
"Ruined the kids college career."
Now why would a common mistake like that cause such a dramatic effect like ruining someones career?
I bet what really happened was that the crowd and the lecturer had a little laugh and that was it. No harm done.
Admin
Admin
"anything to get the stupid the development manager was spouting out of his mouth." You'd think he'd want to stop the stupid from coming out of the manager's mouth. Or does that refer to his own mouth? In that case, why was it there?
Admin
Admin
The 'secure' way is to stick the post-it note under the keyboard.
Admin
I agree with you. So many comments are written to complain about the writing you would believe the audience for TDWTF is an army of English Majors. If you want better stories, share them. As for the writing, yeah it's not perfect, but it's the work of one guy and he does it for free. Seeing the quantity of flak he gets for his work, if I ran this site, I'd have shut down a long time ago. Keep it up Alex, I read every single story you write here. And thank you.
Admin
Admin
Well at the university where I started my studies.. After a time of being in hospital I forgot my e-mail password... That's stupid but understandable (was the response of the helpdesk guy), so I'll e-mail you a new one... I just stared blankly at him
Admin
Admin
So what's to stop the same person who can sniff your email to see the password, sniffing your email to see the link and then going to that link themselves and resetting the password to something they know?
Admin
Most banks I've come across will send you password reset information by post if you forget it. This is less convenient but more secure than doing it by email.
If they have to do it by email, banks should never send emails containing anything you need to click on. Then they can tell their customers the simple rule "we will never send you an email asking you to click on anything, so DON'T CLICK ON ANYTHING YOU RECEIVE BY EMAIL SAYING IT'S FROM US - IT'S NOT". Safer is to send you a random temporary password by email and tell you to go to their website and enter it there - don't give them to link to click on to go there! At that point they should probably also enter some extra personal information - it doesn't have to be ultra secure, just enough to stop someone who saw the email in transit.
Admin