3 ms·
I wonder if there couldn't be some form of automated tooling which creates dummy accounts in your system and looks for leaks of this type?
by stcredzero 7y ago
I wonder if there couldn't be some form of automated tooling which creates dummy accounts in your system and looks for leaks of this type?
- ezekg 7y agoThat's a really interesting idea. Generate unique tokens e.g. for detecting leaked passwords and alert upon any text match within database, logs, etc.
- stcredzero 7y agoIt wouldn't just be for passwords. It would be for any kind of confidential data.
- popotamonga 7y agoSet an one time url as a password. Someone accesses it bam.
- slenk 7y agoAzure has this built into some of their DLP...at least when looking at emails
- dmix 7y agoThe detector would have to run everywhere, not just on your web application. It'd have to check linux/nginx/apache/etc logs, metric systems transit pipes and storage, etc, etc. I guess you could install it as a Linux system which searches through all plaintext traversing the network AND filesystems of the entire infrastructure. Which might be a good business idea if you could pull it off.