News for hackers. Stuff that matters.

A comment on Meta fined $102M for storing passwords in plain text. Parent comment

Re:Meta fined $102M for storing passwords in plain text by vidarh on Saturday September 28, 2024 @06:09AM (#41679244)
Passwords are just data. If said data is not tagged in a way that makes it clear it is a password, finding an algorithm that will successfully blot out passwords in the general case is intractable without being far too aggressive to be useful.

All such tools rely on assumptions about what will be logged following certain rules that the logging can check against - it's not hard to accidentally convert data to a format that when logged happens to fail these kinds of tests.

They should have caught it. But it's not surprising that it occasionally happens.

[ Parent | on HN ]
Re:Meta fined $102M for storing passwords in plain text by nomilk on Saturday September 28, 2024 @06:13AM (#41679259)
Not that hard [1]:

    Rails.application.config.filter_parameters += [
      :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, 
    :ssn, :cvv, :cvc
    ]
[1] https://github.com/rails/rails/blob/8a2e28d7451d5ae4cb194fcc...
[ Parent | on HN ]
Re:Meta fined $102M for storing passwords in plain text by vidarh on Saturday September 28, 2024 @07:06AM (#41679450)
Assuming, of course, that the data is logged as a parameter rather than as a raw string, or as an instance variable in another object, or any number of other ways. Developers thinking it is "not that hard" is a big red flag to me, suggesting odds are high your logs are full of things that should not be there. Using filters is a first step only.
[ Parent | on HN ]
Re:Meta fined $102M for storing passwords in plain text by tjoff on Saturday September 28, 2024 @06:13AM (#41679258)
HN does it, if I post my password it will automatically change it to stars, see: *************
[ Parent | on HN ]
Re:Meta fined $102M for storing passwords in plain text by benmmurphy on Saturday September 28, 2024 @06:17AM (#41679271)
hunter2
[ Parent | on HN ]
Re:Meta fined $102M for storing passwords in plain text by yakshaving_jgt on Saturday September 28, 2024 @06:22AM (#41679280)
correct-horse-battery-staple

Hmm… Not sure if it worked?

[ Parent | on HN ]