3 ms·
You don't have to hold clear-text data around for very long for it to be exfiltrated. And noone said clear-text passwords would just stick around in ram.
by alophawen 5y ago
You don't have to hold clear-text data around for very long for it to be exfiltrated.
And noone said clear-text passwords would just stick around in ram.
- Dylan16807 5y agoYour first sentence seems to describe sticking around and your second sentence says nobody claimed they would stick around? But more directly, "reading RAM for active users" as a method of gaining passwords, written in context as a direct consequence of "the plaintext password being stored in memory", sure sounds to me like a claim that they're sticking around.
- pdpi 5y agoIf my password is only ever kept in RAM during my login process, there’s a small window of time where it can be exfiltrated, it’s only really at risk if there is an attack in progress while I’m logging in. Persistent storage is always susceptible to exfiltration. Nothing is ever 100% secure, but we can limit the exposure, and the blast radius when you do get breached.