5 ms·
Logging passwords for failed logins is an awful security anti-pattern; please don't do that.
by NovemberWhiskey 4y ago
Logging passwords for failed logins is an awful security anti-pattern; please don't do that.
- nousermane 4y agoHint: you'll get quite a few of real passwords with 1-letter typo, written to disk in plan text, and probably copied to 5 different places, possibly some of them external.
- tialaramex 4y agoI mean, you shouldn't, because you shouldn't have anything, anywhere, using password auth. Which doesn't mean it's OK to log passwords if you do have password auth, it means it's not OK to have password auth.
- snovv_crash 4y agoUsing passwords for SSH is also bad security.