2 ms·
If we presume the attackers had access to the system handling authorization, then the attackers introducing code to ship passwords offsite as users log in isn't
by Thalagyrt 11y ago
If we presume the attackers had access to the system handling authorization, then the attackers introducing code to ship passwords offsite as users log in isn't really a stretch of the imagination.
- yeukhon 11y agoThat's true and great point. Let's play devil. You can't really be sure if Google engineer is sloppy and logging username and password on entry and then the SRE reading the log sees everything. I am not sure if their build system has plugin to detect such big red flag. Stacktrace is another place with potential leak of credentials. All of these are reasons when someone claims software is open source and auditable but they run the service themselves, it's really important to note you can't audit the actual server. They can log your username and password behind the scene while the client side appears to be 100% the same as the one on the server side. What you describe is not rare, can be done with cross-site scripting. How it happens depends on the injection method (perhaps SQL injection).