News for hackers. Stuff that matters.

A comment on Ebay posts every character a user types into the password box. Parent comment

Re:Ebay posts every character a user types into the password... by slashcrypto on Wednesday June 29, 2016 @07:41AM (#12000951)
what do you mean? normally passwords are not stored in logfiles ...
[ Parent | on HN ]
Re:Ebay posts every character a user types into the password... by vanwalj on Wednesday June 29, 2016 @08:01AM (#12001049)
"Normally" ? What refrain you from logging HTTP Body ? It's the same problem as logging HTTP query string. You should consider everything you send over HTTPS public for the receiver in any way.
[ Parent | on HN ]
Re:Ebay posts every character a user types into the password... by besselheim on Wednesday June 29, 2016 @08:02AM (#12001051)
The passwords are not necessarily being captured in logfiles, that's a huge assumption. We don't know anything about how eBay stores and manages their web server logs.
[ Parent | on HN ]