3 ms·
Is it common practice to log POST parameters? I've never seen such behavior outside of development environments, but that might be because I've never run a very
by jmillikin 17y ago
Is it common practice to log POST parameters? I've never seen such behavior outside of development environments, but that might be because I've never run a very large web application.
an unscrupulous systems administrator [...] could determine that my password is Th1s1sMyP@ssword just by looking at the logs.
Couldn't the systems administrator simply change the log code to not filter passwords, or to email the password on each successful login attempt? That seems more reliable and productive than waiting for a user to click the wrong input box.
- algorias 17y ago> Couldn't the systems administrator simply change the log code to not filter passwords, or to email the password on each successful login attempt? Not without leaving traces in the system that could be found by his coworkers.
- bricestacey 17y agoThis is probably a good reason for client-side, 1-way, password encryption. Even if the password is protected with SSL, encrypted passwords would make it even more difficult for unscrupulous system administrators to crack passwords on a large scale.
- bugs 17y agoIf so, how do you prevent them from using the encrypted password in the same way?
- psadauskas 17y agoA system similar to digest auth, involving a handshake.