Ban me at the IP level if you don't like me

Re:Ban me at the IP level if you don't like me by zeta0134 on Monday August 25, 2025 @11:04AM (#45014657)

Just about nobody logs passwords on purpose. But really stupid IoT devices accept credentials as like query strings, or part of the path or something, and it's common to log those. The attacker is sending you passwords meant for a much less secure system.

[ Parent | on HN ]

Re:Ban me at the IP level if you don't like me by SoftTalker on Monday August 25, 2025 @12:12PM (#45015432)

You probably shouldn't log usernames then, or really any form fields, as users might accidentally enter a password into one of them. Kind of defeats the point of web forms, but safety is important!

[ Parent | on HN ]

Re:Ban me at the IP level if you don't like me by Dylan16807 on Monday August 25, 2025 @04:25PM (#45018570)

Are you using a very weird definition of "logging" to make a joke? Web forms don't need any logging to work.

[ Parent | on HN ]

Re:Ban me at the IP level if you don't like me by SoftTalker on Tuesday August 26, 2025 @09:32PM (#45034446)

You save them in a database. Probably in clear text. Six of one, half-dozen of the other.

[ Parent | on HN ]

Re:Ban me at the IP level if you don't like me by Dylan16807 on Tuesday August 26, 2025 @11:13PM (#45035077)

A password being put into a normal text field in a properly submitted form is a lot less likely than getting into some query or path. And a database is more likely to be handled properly than some random log file.

Six of one, .008 of a dozen of the other.

[ Parent | on HN ]

Re:Ban me at the IP level if you don't like me by hinkley on Monday August 25, 2025 @06:04PM (#45019660)

So no access logs at all then? That sounds effective.

[ Parent | on HN ]