2 ms·
A scenario for leaking passwords would be (from a comment of mine below): >Someone naively sets up error reporting that takes the POST data and logs it somewhe
by underyx 10y ago
A scenario for leaking passwords would be (from a comment of mine below):
>Someone naively sets up error reporting that takes the POST data and logs it somewhere. Employees can now see the passwords from POST data and impersonate each other, or in an even worse case, a vulnerability with the error reporting software can leak the passwords to the public.
I guess the second point is fair.
- dozzie 10y agoYou don't have any way of defending against that stupid scenario, with or without centralized passwords. Additionally, most of the users would probably use the same password for each of the services anyway, so you have pretty much the same situation in both cases, only you don't have a quick and reliable way to invalidate all the passwords.