As a manager in software engineering: this! If I learned that one of my devs was wasting time like this, I’d want to know. Just make sure to stick to the facts.

Remote wipes are possible. Log into your Apple/Google account, figure out how to find your device, then perform a remote wipe.

If tomorrow’s race goes on as planned and Stroll participates, that’s tomorrow’s race. If for some reason Stroll can’t participate tomorrow, he won’t escape this penalty.

I’m going to have to stop replying because I don’t have the time to run every individual through infosec 101.

Sorry, but you’re missing the point here. You cannot do anything with a password without storing it in memory. That’s not even infosec 101, that’s computing 101. Every computation is toggling bits between 1 and 0 and guess where these bits are stored? That’s right: in memory.

The backend should never have access to a variable with a plaintext password.

You know how the backend gets that password? In a plaintext variable. Because the server needs to decrypt the TLS data before doing any computations on it (and yes I know about homomorphic encryption, but no that wouldn’t work here).

Yes, I agree it’s terrible form to send out plain text passwords. And it would make me question their security practices as well. I agree that lots of people overreacted to your mistake, but this thread has proven that you’re not yet as knowledgeable as you claim to be.

Slightly NSFW: Video of how it happened