3 ms·
> Usually it's in the logs. That is definitely not usual
by herbst 5y ago
> Usually it's in the logs.
That is definitely not usual
- thaumasiotes 5y agoIt's pretty common; a lot of places have blanket logging and it hasn't occurred to them to disable it for login attempts. It is obviously undesirable.
- herbst 5y agoNot sure what you mean. By default nether Apache nor Nginx log any post data. So with the 2 most popular options you actually have to go out of your way to enable this. On the application side I mostly know Rails and it redacts even password hashes.
- Jwarder 5y agoFacebook reported that they logged passwords in plaintext by accident a couple of years ago. https://about.fb.com/news/2019/03/keeping-passwords-secure/ https://about.fb.com/news/2019/03/keeping-passwords-secure/