3 ms·
I often wonder how many authentication log files contain passwords because people in a hurry append it to the username on accident (not visually confirming the
by j_s 9y ago
I often wonder how many authentication log files contain passwords because people in a hurry append it to the username on accident (not visually confirming the Tab/Enter/switch to the password entry).
This is also vaguely similar to the 'test SSL submit' security technique of first entering enough data into login forms to process a submission, and then entering real login info into the 'login failed' retry page after verifying SSL. This has lost some of its luster as non-SSL form submission has fallen out of wide usage.
- teekert 9y agoYeah, pretty sure mine is in clear text in some ssh auth.logs. Yeah yeah, I should use encryted keybased login (I try to mostly do it.)
- j_s 9y agoI typically require both when others are involved since proper key security can't be enforced (hardware 2FA is the dream). AuthenticationMethods requiring both wasn't availabe in OpenSSH prior to v6.2 (May 2013)[1] and I'm on Windows anyway so I went with https://www.bitvise.com/ssh-server https://www.bitvise.com/ssh-server. https://serverfault.com/a/562899 https://serverfault.com/a/562899
- hhbbhhg 9y ago> I often wonder how many authentication log files contain passwords because people in a hurry append it to the username on accident Is this why everyone does 2-step login on websites now?