I've been training a client for a few months now to not use Slack for sharing passwords and other secure materials.

I really thought I had made great progress. I even had him using a password manager. Then out of nowhere he sends the wildcard SSL key pair to me and a handful of other devs in a Slack thread.

At least we aren't storing important information like medical records. Oh wait, that's exactly what we're doing.

Why would he even have that in the first place?

@YouAreAPIRate his devops guy gave it to him. Believe me, I would never trust him with the SSL keys. Unfortunately, the guys is technical enough to think he knows what he's doing. It's proving to be extremely dangerous.

@blackmarket you poor soul. Oh, now that the keys are compromised me can give them to me too, right? :P

@YouAreAPIRate I second that.

@YouAreAPIRate his name says it all! For a price ....

Fucking devs...

Months of training undone by a single paste is the most realistic part of this. He almost certainly felt efficient doing it too - password manager for storing, chat for sending, no perceived contradiction between the two.

The only thing that ever worked for me was making the safe path faster than the unsafe one instead of adding another rule: a one-time link they paste into the thread that dies the moment it's read. I built a tiny thing for exactly that (s3cr3tm3.netlify.app) after one too many credentials went permanently into someone's scrollback. Doesn't help with the medical records part, sadly.