4 ms·

You should not be backing up plaintext passwords to offsite storage anywhere. Or do you mean malicious JS capturing your form entry at login?

• dannyw 6y ago
  That's what I mean. But the specific issue I see is that a piece of external JS got inserted into their web app, and their security team didn't realise it. The fact that its from GTM is no excuse: give me Google tag manager, I'll exfil your users data in an hour ;)
  • jscheel 6y ago
    Ahh, fair enough. They definitely snippets to be vetted by their security team. I'm sure they've learned from this mistake though, and I'm not sure I would trust anyone else any more than them.
    • magicalhippo 6y ago
      It would be far better if they described how they managed to let Google Tag Manager be included for so long, and how they've changed their deployment process to avoid third-party scripts from being included in the future.
  • deleted 6y ago
    [deleted]