3 ms·
I would agree. Although technically if they were accidentally in a log (the likely scenario) that does mean they were being stored.
by pbreit 7y ago
I would agree. Although technically if they were accidentally in a log (the likely scenario) that does mean they were being stored.
- dmix 7y agoThe distinction still matters and I give Robinhood credit for admitting it and immediately notifying their users. Security is a long term investment and it's easy to mess up. Taking responsibility and being transparent when you don't is the only way you're going to get it right. There are some reverse proxies that are being sold as a way to mirror HTTP data to metric/analytics systems, which would bypass built-in filtering mechanisms which automatically remove passwords from logs (as Rails does). Metric/big data systems are an easy place for sensitive data leaks to happen. So your web developers could be getting security 100% right but some higher level systems integration with an analytics or ops software (requested by marketing or BI guys or whatever) could mess it up.