Twitter urges users to change passwords after computer 'glitch'

Re:Twitter urges users to change passwords after computer 'g... by xamuel on Thursday May 03, 2018 @09:31PM (#16991531)

Not exactly log files, but I once noticed a C coredump contained raw passwords in strings that had been free'd but not explicitly overwritten. Similar to how Facebook "deletes" files by merely marking them as deleted, "free" works the same way in C, the memory isn't actually overwritten until something else writes onto it.

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by cm2187 on Friday May 04, 2018 @03:45AM (#16992878)

But if you have access to the programs memory you have access to all the post requests anyway.

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by larkeith on Friday May 04, 2018 @09:33AM (#16994462)

Aren't coredumps static copies of the memory state at time of termination - usually unplanned? So not really the same thing as having ongoing access to a program's memory; I can't really see a debugging process that would involve viewing memory in a dynamic way, whereas it's somewhat of a concern if coredumps (an important debugging tool) reveal plaintext passwords.

[ Parent | on HN ]