this post was submitted on 01 Oct 2024
213 points (99.5% liked)

Privacy

32412 readers
385 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
213
Meta fined $101 million by Ireland for storing hundreds of millions of passwords in plaintext (therecord.media)
submitted 2 months ago by [email protected] to c/[email protected]
37 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 13 points 2 months ago (1 children)

This is not about facebook not hashing credentials, it is that they appeared in internal logs.

Facebook is probing a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers.

Source: Krebs on Security

[–] [email protected] 3 points 2 months ago (2 children)

that logged unencrypted password data

Why the fuck would you need to log a password ever? This is absolutely malice and not incompetence.

[–] [email protected] 8 points 2 months ago (2 children)

You are acting like someone checked off a "log passwords" box, as if that's a thing that even exists

Someone configured a logger to write HTTP bodies and headers, not realizing they needed to build a custom handler to iterate through every body and header anonymizing any fields that may plausibly contain sensitive information. It's something that literally every dev has done at some point before they knew better.

[–] [email protected] 3 points 2 months ago* (last edited 2 months ago) (1 children)

It’s something that literally every dev has done at some point before they knew better.

If you're working for a multinational tech company handling sensitive user data and still make this mistake, then you are being malicious in your incompetence. This is something that would cause you to lose a significant amount of marks on a first year college programming project, let alone a production system used by literally billions of people.

[–] [email protected] 2 points 2 months ago

I can't tell you how many times I've seen passwords appear in logs. Its always a struggle, everywhere.

Use TOTP

[–] [email protected] -2 points 2 months ago (1 children)

You should never be sending passwords to a server. That is really bad practice. The right answer is to use cryptography to verify the client knows the password.

[–] [email protected] 2 points 2 months ago (1 children)

Client side verification is just security by obscurity, which gains you very little.

If someone is capable of MITM attacking a user and fetching a password mid-transit to the server over HTTPS, they are surely capable of popping open devtools and reverse engineering your cryptographic code to either a) uncover the original password, or b) just using the encrypted credentials directly to authenticate with your server without ever having known the password in the first place

[–] [email protected] 1 points 2 months ago (1 children)

That assumes that an adversary has control of the browser. The big reason you don't want to send passwords over https is that some organizations have custom certs setup. It is better to just not send the password at all.

[–] [email protected] 1 points 2 months ago

That assumes that an adversary has control of the browser

No it doesn't, if they intercept an encrypted password over HTTPS they can resend the request from their own browser to get access to your account

The big reason you don't want to send passwords over https is that some organizations have custom certs setup

What is the problem with that? The password is secure and only shared between you and the site you are intending to communicate with. Even if you sent an encrypted password, they wrote the client side code used to generate it, so they can revert it back to its plaintext state server side anyways

It is better to just not send the password at all.

How would you verify it then?

If not sending plaintext passwords was best practice then why do no sites follow this? You are literally posting to a site (Lemmy) that sends plaintext passwords in its request bodies to log-in

[–] [email protected] 5 points 2 months ago* (last edited 2 months ago)

Just one open source example ... freeradius has an option to log passwords:

log {
    destination = files
    auth = no
    auth_badpass = no
    auth_goodpass = no
}

Or another example: The apache web server has a module that dumps all POST data, with passwords, in plain text:

mod_dumpio allows for the logging of all input received by Apache and/or all output sent by Apache to be logged (dumped) to the error.log file. The data logging is done right after SSL decoding (for input) and right before SSL encoding (for output). As can be expected, this can produce extreme volumes of data, and should only be used when debugging problems.

I don't agree that this is "absolutely malice", it could also be stupidity and forgetfulness.