4 ms·
>We do not expect every company to have infra/ops setup to prevent logging on login requests. What? I absolutely expect every company to not log my password in
by nck4222 8y ago
>We do not expect every company to have infra/ops setup to prevent logging on login requests.
What? I absolutely expect every company to not log my password in plain text. In my 15 years as a developer across several companies and industries, I have never seen anybody log passwords, or advocate for logging passwords.
I'm struggling to think why any employee of any company should be able to view a plain text password in any form. Why would there not be an expectation here?
- viraptor 8y agoYou're taking about expectation not to log the password. That's fine. The parent was taking about expectation about infrastructure that validates this. This is both very uncommon and impossible to do 100% correctly. You can scan logs for a prefix (password=), you can do entropy counting, you can try to decode hex values in text. But if you find a base64 encoded hex string representing "foobar" - how do you even know it's a password? Short of trying all possible decodings of all possible substrings against your full password database, this is an impossible task. (You can do best-effort things though)
- nck4222 8y agoAh ok thanks, I misunderstood.