News for hackers. Stuff that matters.

A comment on Robinhood Stored Passwords in Plaintext. Parent comment

Re:Robinhood Stored Passwords in Plaintext by trianglesphere on Wednesday July 24, 2019 @04:41PM (#20519434)
I agree that it's likely a log file. I remember hearing about Twitter doing this (I also just found out that github may have done this as well).

https://www.bleepingcomputer.com/news/security/twitter-admit...

[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by stevezsa8 on Wednesday July 24, 2019 @04:54PM (#20519569)
I worked at a place where on incorrect login, we recorded your attempt (with whatever was in the user/password field) into the logs. The logs went to data warehouse too. That was a fun day in the office :P
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by sofaofthedamned on Wednesday July 24, 2019 @04:55PM (#20519591)
Exactly. They've got Kibana or similar setup with uri traces, tonnes of companies have been caught up with this same issue.
[ Parent | on HN ]
Re:Robinhood Stored Passwords in Plaintext by sroussey on Thursday July 25, 2019 @01:47AM (#20522888)
Not palantir, their logging system defaults to not writing unknown values.
[ Parent | on HN ]