> Just noting a somewhat less than universal interest in compliance issues.
Is there a compliance document that requires this approach?
Or is it that the compliance states reasonable safety whilst handling PII and security credentials, and that it is down to the interpretation by each individual company as to what that means.
Re:Robinhood Stored Passwords in Plaintext
by mijoharas on Thursday July 25, 2019 @09:53AM
(#20525339)
GDPR covers fines for logging sensitive things like passwords. There is additional separate certification needed if you're handling any payment details (i.e. Card numbers) yourself
Re:Robinhood Stored Passwords in Plaintext
by raverbashing on Thursday July 25, 2019 @05:30AM
(#20523916)
Any recommendations of tools/libraries that help with this sort of testing/analysis?
Yes. I thought that was pretty common practice. We catch PII (not just password) log-leaks this way that verifying this way often enough that our developers have even learned[1] to check the searches before we yell at them when they try to take something leaky to prod.
If you don't automate detection of things like this you will make the same mistake again.
[1] Not being down on developers, I used to be one and still write a lot of code. Just noting a somewhat less than universal interest in compliance issues.