3 ms·
> good practice to use a sentinel value for a password during testing and grep logs Yes. I thought that was pretty common practice. We catch PII (not just pass
by _jal 7y ago
> good practice to use a sentinel value for a password during testing and grep logs
Yes. I thought that was pretty common practice. We catch PII (not just password) log-leaks this way that verifying this way often enough that our developers have even learned[1] to check the searches before we yell at them when they try to take something leaky to prod.
If you don't automate detection of things like this you will make the same mistake again.
[1] Not being down on developers, I used to be one and still write a lot of code. Just noting a somewhat less than universal interest in compliance issues.
- raverbashing 7y agoAny recommendations of tools/libraries that help with this sort of testing/analysis?
- buro9 7y ago> Just noting a somewhat less than universal interest in compliance issues. Is there a compliance document that requires this approach? Or is it that the compliance states reasonable safety whilst handling PII and security credentials, and that it is down to the interpretation by each individual company as to what that means.
- mijoharas 7y agoGDPR covers fines for logging sensitive things like passwords. There is additional separate certification needed if you're handling any payment details (i.e. Card numbers) yourself