Meta fined $102M for storing passwords in plain text

Re:Meta fined $102M for storing passwords in plain text by nomilk on Saturday September 28, 2024 @06:13AM (#41679259)

Not that hard [1]:

    Rails.application.config.filter_parameters += [
      :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, 
    :ssn, :cvv, :cvc
    ]

[1] https://github.com/rails/rails/blob/8a2e28d7451d5ae4cb194fcc...

[ Parent | on HN ]

Re:Meta fined $102M for storing passwords in plain text by vidarh on Saturday September 28, 2024 @07:06AM (#41679450)

Assuming, of course, that the data is logged as a parameter rather than as a raw string, or as an instance variable in another object, or any number of other ways. Developers thinking it is "not that hard" is a big red flag to me, suggesting odds are high your logs are full of things that should not be there. Using filters is a first step only.

[ Parent | on HN ]