8 ms·
but only ever in memory. writing to disk is the issue here.
by djtriptych 4y ago
but only ever in memory. writing to disk is the issue here.
- UncleMeat 4y agoBut there is no evidence that they are writing the passwords to disk.
- djtriptych 4y agoI'm talking about authenticating servers in general, not just lenovo.
- lxgr 4y agoThey are writing the passwords to users' disks at least, which by itself is already really bad and easily avoidable.
- UncleMeat 4y agoHow is that bad? If you've got malware on your machine then you are already fucked. Desktops don't tend to have strong process isolation that keeps malware from reading a password in flight anyway.
- icedchai 4y agoOften, it is plaintext over the internal network. A TLS/SSL terminating load balancer decrypts the traffic, then your request is in clear text as it hits the internal web or app server. It can be sniffed and logged without modifying the application.