2 ms·
It does prevent inadvertent logging of passwords, though: no piece of software on the server side will have the user's password in memory at any point. Which do
by yuliyp 5y ago
It does prevent inadvertent logging of passwords, though: no piece of software on the server side will have the user's password in memory at any point. Which does mean the user's actual password (if they're reusing passwords) stays more secure (by "more secure" I mean "has a lower probability of leaking to a malicious actor", not necessarily "has some additional security properties").
- chrisfosterelli 5y agoAh yes that's a good point. It can still leak the "password" that's used for authentication so it doesn't protect their account on that service but logs wouldn't leak the original password that might be reused elsewhere so it could protect their account on other services marginally more.