5 ms·
As the article mentions, Twitter disclosed a similar mistake a year ago...and GitHub before them. These are just the organizations responsible enough to say som
by madrox 8y ago
As the article mentions, Twitter disclosed a similar mistake a year ago...and GitHub before them. These are just the organizations responsible enough to say something.
Can we take a moment to acknowledge that this is an easy mistake to make? A logger doesn't care if it's a password or not. Strings are strings. As long as the answer is "humans should be more careful" we'll be seeing these kinds of disclosures regularly across the industry.
My best attempt to address this in my teams has been to use different data types for different data classifications. Naked strings must be loaded in one of these data types after input sanitization. That makes it easier to catch accidental inappropriate use. This is useful for managing PII as well.
- skybrian 8y agoYes, this is an industry-wide problem. Many logging API's are designed for convenience, not security. We need systematic solutions that are still easy to use (or they won't be used).
- gwbas1c 8y agoThat's why modern languages need something like a typedef! At least C# has a concept of a SecureString for things like passwords.
- saagarjha 8y agoHow does SecureString actually work? Presumably it's possible to coerce one into a "normal" string, and I'm sure that someone will end up doing this in the codebase because it's more convenient to work with.
- gwbas1c 8y agoThe point of SecureString is to ensure that sensitive information gets removed from RAM in a timely manner. It's just a wrapper around some native memory that gets zeroed when the SecureString object is disposed. Otherwise, when you use standard C# strings, you don't know when the garbage collector will collect them. (Granted, you could do similar things with pinning a char[] to a char* and zeroing it before you end the pin, but who wants to jump through those hoops?)
- saagarjha 8y agoBut what I want to pass a SecureString to someone? Doesn't a copy have to take place in that case?
- koyote 8y agoFWIW SecureString should not be used: https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md https://github.com/dotnet/platform-compat/blob/master/docs/D...
- gwbas1c 8y ago> The general approach of dealing with credentials is to avoid them and instead rely on other means to authenticate, such as certificates or Windows authentication. Sure... I bet you eat right and get plenty of exercise, right? Anyway, that link appears to be best practices when writing cross-platform code.
- saagarjha 8y agoInterestingly, Apple seems to have something like this in place where format strings, by default, are not logged (they show up as <private>). I'm thinking that something like this might be useful to have in general.
- sesteel 8y agoI mean, yeah it is easy to make but it is also easy to fix. How long did this occur prior to correction? 1000's of searches for said data in the logs. I suspect we are only hearing about it because Facebook, all of a sudden, has been publicly humiliated multiple times for poor engineering/business practices and has decided that it is time to grow up and take privacy seriously. Otherwise, they risk their existence.