4 ms·

> Unrelated to the OAuth token attack, we also recently internally discovered the storage of plaintext credentials in GitHub’s internal logging system for npm s

> Unrelated to the OAuth token attack, we also recently internally discovered the storage of plaintext credentials in GitHub’s internal logging system for npm services This isn't the first time GitHub has found logging of plaintext credentials [0]; it's not a good look, for a company with the resources that GitHub has, to have to disclose it again almost exactly 4 years later. [0] https://www.zdnet.com/article/github-says-bug-exposed-account-passwords/ https://www.zdnet.com/article/github-says-bug-exposed-accoun...

tinus_hn 4y ago
This happens all the time in a lot of companies, you just don’t hear about it.
- rmbyrro 4y ago
  Never seen plain text credentials being logged in systems I've looked at. PII, sure, even login usernames or email, also sure, but not credentials (plain text passwords, tokens, etc).
  - bastardoperator 4y ago
    LOL, literally entire products designed to prevent and report on these issues. Just because you haven't seen it doesn't mean it isn't happening daily unfortunately.
  - deleted 4y ago
    [deleted]
  - mschuster91 4y ago
    Say someone implemented oauth or whatever fancy auth mechanism in a dockerized software and had the problem that the environment variable containing the secrets were not passed through the layers to the application server, and so the developer (as they didn't have SSH access to the machine or the container) was forced to build in a lot of logging to discover where in the path the secrets got lost. Then the developer forgot to remove all logging incantations.
  - tinus_hn 4y ago
    If users login through some web form the credentials can end up in a log because the web server logs the form parameters (or the URL and the parameters are in the URL). Not good but it happens.
    - rmbyrro 4y ago
      I think inserting credentials in a URL in the first place is the problem. Always send it in the request body. Never configure a webserver to log request bodies, they'll eventually contain sensitive information.
      - bastawhiz 4y ago
        You're assuming they were in the URL and that only the URL was logged. APIs are extremely fraught, because users like to build integrations that jam credentials into the wrong places until they get a 200. You haven't lived until you've added a regexp for your API keys appearing in the wrong HTTP headers
  - ezekg 4y ago
    I've seen it quite a bit, even at fintech companies I've worked at. I mean, I've seen passwords show up in SQL slow query logs before (and other SQL errors, e.g. on conflicts). It happens. You fix the issue, purge the logs, and learn from it.
  - deleted 4y ago
    [deleted]
- philsnow 4y ago
  100% agree, but for most companies disclosing it once makes it a high-priority issue for it to never be an issue again; 0.1%-1% of the engineering org gets tasked with making some framework for logging, making sure there's no way to log outside the framework, and chasing down stragglers who can't/won't use it to get their management chain to accept the risk of it recurring in their little corner of production.
deleted 4y ago
[deleted]

tinus_hn 4y ago

This happens all the time in a lot of companies, you just don’t hear about it.

rmbyrro 4y ago
Never seen plain text credentials being logged in systems I've looked at. PII, sure, even login usernames or email, also sure, but not credentials (plain text passwords, tokens, etc).
- bastardoperator 4y ago
  LOL, literally entire products designed to prevent and report on these issues. Just because you haven't seen it doesn't mean it isn't happening daily unfortunately.
- deleted 4y ago
  [deleted]
- mschuster91 4y ago
  Say someone implemented oauth or whatever fancy auth mechanism in a dockerized software and had the problem that the environment variable containing the secrets were not passed through the layers to the application server, and so the developer (as they didn't have SSH access to the machine or the container) was forced to build in a lot of logging to discover where in the path the secrets got lost. Then the developer forgot to remove all logging incantations.
- tinus_hn 4y ago
  If users login through some web form the credentials can end up in a log because the web server logs the form parameters (or the URL and the parameters are in the URL). Not good but it happens.
  - rmbyrro 4y ago
    I think inserting credentials in a URL in the first place is the problem. Always send it in the request body. Never configure a webserver to log request bodies, they'll eventually contain sensitive information.
    - bastawhiz 4y ago
      You're assuming they were in the URL and that only the URL was logged. APIs are extremely fraught, because users like to build integrations that jam credentials into the wrong places until they get a 200. You haven't lived until you've added a regexp for your API keys appearing in the wrong HTTP headers
- ezekg 4y ago
  I've seen it quite a bit, even at fintech companies I've worked at. I mean, I've seen passwords show up in SQL slow query logs before (and other SQL errors, e.g. on conflicts). It happens. You fix the issue, purge the logs, and learn from it.
- deleted 4y ago
  [deleted]
philsnow 4y ago
100% agree, but for most companies disclosing it once makes it a high-priority issue for it to never be an issue again; 0.1%-1% of the engineering org gets tasked with making some framework for logging, making sure there's no way to log outside the framework, and chasing down stragglers who can't/won't use it to get their management chain to accept the risk of it recurring in their little corner of production.

deleted 4y ago

[deleted]