4 ms·

An easy mistake with serious potential consequences. I'd be interested in hearing how Facebook will prevent this from happening again in the future

• sethammons 8y ago
  A lot of folks are angry about this, but I'm not seeing much in they way of "this is how that should be handled" aside from "be vigilant." The closest is "encrypt logs," but those logs exist to be seen, else they wouldn't exist.
  • qpiox 8y ago
    Hash client side. Send hash. This is how it is done for 20 years (by those who truly care about the users).
    • NoodleIncident 8y ago
      If this is so common, it should be easy for you to provide a link to the javascript password hasher on a site you use. Does this site do that? Pretty sure it doesn't. But you sound very confident about this, so I'm sure you'll have no trouble finding some other site that handles its passwords this way.
    • crazygringo 8y ago
      What?! No!!! As many have said before, transmitting the hash simply turns the hash into the password itself. Anyone who has your hash, has your password. The biggest reason for hashing is that, even if an attacker gets access to the hashed passwords, they still can't use them to log in. Client-side hashing completely and utterly undoes that benefit. Passwords in transit should be protected by SSL. Not a hash.
      • jeltz 8y ago
        You should check out SCRAM. It solves this problem without sending the hash or the plain text.
        • crazygringo 8y ago
          Fascinating. Yes that does solve the problem, and most importantly doesn't send the hash (unlike what the commenter I was responding to was suggesting, which continues to horrify me). Most interestingly, it solves the problem where the server may not be trusted. I see how this would have protected against the Facebook problem. I'm curious, have any major websites you're aware of adopted SCRAM as a best security practice? It feels kind of like overkill, since generally the server is considered to be trusted... but at the same time, it would definitely prevent accidental logging.
          • jeltz 8y ago
            I have not heard of any website using SCRAM, but recent versions of PostgreSQL use it for password authentication.
• x38iq84n 8y ago
  The solution is trivial: a watchdog. Have a watchdog log into a dummy account with a "well-known" password and then inspect logs for that well-known password.
  • nuclear_eclipse 8y ago
    That doesn't necessarily help when logs are sampled. Eg, for high volume services or endpoints, only 1 in X,000 requests might be logged, and you have no theoretical guarantee that you would ever catch any one individual request in your logs.
    • x38iq84n 8y ago
      Good point, though I consider that as just an implementation detail. Bypass sampling for designated system accounts and you will be able to see if systems leak cleartext secrets into logs or not.