I once had configured a mail server to log passwords while I was figuring out how to set it up. Then, I turned on logwatch and started using it “for real”. Sometime later, while reading through the logs that logwatch was sending to gmail, I discovered that I had been emailing myself login credentials via plain-text emails.
Twitter urges users to change passwords after computer 'glitch'
331–340 of 490 posts
Re: Twitter urges users to change passwords after computer 'glitch'
#332Earlier quoted context omitted.
Genuine question—how would this bug be produced in the first place? My (limited) experience makes me think that cleartext passwords are somehow hard coded to be logged, perhaps through error logging or a feature that’s intended for testing during development. I personally would not code a backend that allows passwords (or any sensitive strings) to be logged in any shape or form in production, so it seems a little wei…
Let's say you log requests and the POST body parameters that are sent along with them. Oops, forgot to explicitly blank out and fields known to contain passwords. Now they're saved in cleartext in the logs every time the user logs in.
[deleted]
Re: Twitter urges users to change passwords after computer 'glitch'
#333Twitter hasn't figured out how to properly handle passwords after over a decade of its existence? No, I'm not changing my password, I'm deleting my Twitter account for good.
I'm tired of big shot Internet companies getting away with such bland disregard of basic security and privacy rules.
Re: Twitter urges users to change passwords after computer 'glitch'
#334Earlier quoted context omitted.
And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions
I don't think "Yoda notation" is good advice. How do you prevent mistakes like the following with Yoda notation? if ( level = DEBUGLEVEL ) When both sides of the equality sign are variables, the assignment will succeed. Following Yoda notation provides a false sense of security in this case. As an experienced programmer I have written if-statements so many times in life that I never ever, even by mistake, type: if (a…
And if you write f# or Java code?
Re: Twitter urges users to change passwords after computer 'glitch'
#335Earlier quoted context omitted.
And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions
In this specific case DEBUGLEVEL should be a constant anyways, and thus assignment should fail, no? Also kind of denoted by being all caps.
Which language would stop/warn you assigning the value of a constant to a variable? Doesn't "var = const" just work in most languages?
Re: Twitter urges users to change passwords after computer 'glitch'
#336Earlier quoted context omitted.
You can store things as follows. Store the salted hashed password with its salt server side. When the user wants to login send them the salt and a random salt. Client side hashes the password + salt then hashes that hash with the random value. What am I missing? Probably something since this is something I rolled my own version of when I was a teenager, but it's not immediately obvious to me.
So let me make sure we're on the same page... -- Server stores hashed-password, hash-salt, and random-salt. Server sends hash-salt, and random-salt to client. Client uses user password and hash-salt to generate hashed-password. Client hashes hashed-password using random-salt. Client sends hashed-hashed-password to server. Server grabs stored hashed-password and hashes used stored random-salt to check for match agains…
This is true. It does prevent an attacker from reusing a password they recover from your logs. But as others have pointed out a DB breach means all your users are compromised. Thank you.
Re: Twitter urges users to change passwords after computer 'glitch'
#337Earlier quoted context omitted.
You can store things as follows. Store the salted hashed password with its salt server side. When the user wants to login send them the salt and a random salt. Client side hashes the password + salt then hashes that hash with the random value. What am I missing? Probably something since this is something I rolled my own version of when I was a teenager, but it's not immediately obvious to me.
It's unclear to me how your random salt would work. From my understanding, you're suggesting smth like: register: send (username, user_salt, HMAC(user_salt, pwd)) login: send (username). retrieve user_salt. retrieve a server_salt generated randomly. send HMAC(server_salt, HMAC(user_salt, pwd)) But now your password is effectively just HMAC(user_salt, pwd), and the server has to store it in plaintext to be able to ver…
Nope, that's what I was suggesting and I see now where it's weak.
Re: Twitter urges users to change passwords after computer 'glitch'
#338Earlier quoted context omitted.
You can store things as follows. Store the salted hashed password with its salt server side. When the user wants to login send them the salt and a random salt. Client side hashes the password + salt then hashes that hash with the random value. What am I missing? Probably something since this is something I rolled my own version of when I was a teenager, but it's not immediately obvious to me.
The problem with this scheme is that if database storing the salted hashed passwords is compromised, then an attacker can easily log in as any user. In a more standard setup, the attacker needs to send a valid password to log in, which is hard to reverse from the salted hashed password stored server-side. In this scheme, the attacker no longer needs to know the password, as they can just make a client that sends the…
Very true, I had not considered that possibility.
Re: Twitter urges users to change passwords after computer 'glitch'
#339Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.
Wouldn't have happend with Rails... http://api.rubyonrails.org/classes/ActionDispatch/Http/Filte...
Of course it could have! No API is foolproof
Re: Twitter urges users to change passwords after computer 'glitch'
#340Twitter hasn't figured out how to properly handle passwords after over a decade of its existence? No, I'm not changing my password, I'm deleting my Twitter account for good. I'm tired of big shot Internet companies getting away with such bland disregard of basic security and privacy rules.
Its a mistake , it happens. Software is hard. Change your password.