Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it legal to store/log mistyped passwords?

How many of you have seen this happen in a log file or DB?

share|improve this question
    
If you and the user agree on such a behavior, I guess there is no law that forbids this. But why would you want to do that? –  Gumbo Oct 23 '11 at 13:35
6  
I guess it is obvious that this is a extremely bad idea from a security perspective because the wrong password are most likely extremely close to the real one. As for the legal aspect, you forgot to mention for which country your are asking. I would not do this in Germany for example. –  Hendrik Brummermann Oct 23 '11 at 13:42
4  
Related is the problem of logging the usernames of people who have put in the wrong password. This is a security risk because the username is often the correct password when the user is out of sync with the user: password: prompts. –  Jerry Oct 24 '11 at 1:42
    
I dunno about passwords but it seems legal to log and sell the users of failed logins: "The Wall Street Journal divulged to seven of its partners the email address of users who enter the wrong password" –  Gennady Vanin Геннадий Ванин Nov 9 '11 at 7:06
    
Isn't there some risk you could be prosecuted for a lesser "attempted" variant of computer intrusion (hacking), or some anti-phishing statute, if the prosecutor argued that you intended to use the information maliciously? –  Jeff Burdges Dec 2 '11 at 16:54

5 Answers 5

up vote 22 down vote accepted

I don’t think that “legal” is the right term to use.

It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password.

Other problem is that people re-use passwords, so they use same password for your site/gmail/facebook/bank. So even if your site doesn’t have sensitive information about users, it’s very possible that getting user’s credentials from your site will let hacker access other user’s accounts (email/CC/bank). And you don’t want to be a source of something like that.

share|improve this answer
2  
I heard this for the first time from a friend who found out, his company was doing this with their software. He is working in the IT dept. and every time a user would enter a wrong PW, it would be logged in a DB. This threw me off and that's why I was asking here... it's not something I'm going to do :) –  Olivier Oct 23 '11 at 17:17
    
What you could do is store the hash (using the exact same way you store passwords in your user table) of the login attempt. At least you will know how many failed login attempts have been made and when. Some legwork would let you know if this is a naive dictionary attack or whatever. –  bobobobo Jun 5 '13 at 20:26

Very bad idea indeed. People sometimes enter the password for another site. If that were logged it would be valuable information for anyone you can access the log. One can often guess from a small number of sites for which of these the password is correct.

share|improve this answer

As mentioned, it is perfectly legal in many jurisdictions, as the owner of the machine can do what they want with this data (it doesn't count as personal data under most data protection statutes)

But it raises a risk - that the viewer of those logs could build up a good idea of people's passwords, which removes the auditability of actions (they could log in as the individual whose password has been logged) so it would be a very bad idea, and in regulated industries would raise a problem!

share|improve this answer
    
So, in those jurisdictions, you wouldn't even have to inform the customer of such a possibility? Somewhat a scary thought... –  Olivier Oct 23 '11 at 20:29
2  
@Oliver - you'll often find a comment in the terms and conditions mentioning that anything/everything may be logged. –  Rory Alsop Oct 24 '11 at 7:38

To add to previous answers, you should not log the username either, it's pretty common that people get "out of sync" and type their password in the login field (bad UI being the main culprit here).

share|improve this answer
    
That's a good point @Bruno –  Rory Alsop Oct 25 '11 at 12:31
    
I just saw @Jerry actually made the same point a lot earlier in a comment to the OP –  Bruno Rohée Oct 25 '11 at 14:47
1  
The username used in failed logins is a potentially useful information that can used to detect ongoing attacks. OTOH, if a particular user, on a given TCP connexion, mistype his password then uses the correct password, there is no need to record the failed attempt. –  curiousguy Jul 5 '12 at 16:58

I have seen that not only the password is stored in DataBase, but also the username, so the DBA or someone who has access to the list of log, could imagine the correct credential.

Does this type of log information has worth? IMO no, because it is better in terms of security that the website informs the user with an alert email about "failed logins". The only worth it could have to log that information is to (1) know the pattern that some hacker is trying to use to log in (2) and which user is considering.

share|improve this answer
    
An email: after how many incorrect passwords? How many consecutive emails? –  curiousguy Jul 5 '12 at 17:03
    
(1) After each incorrect password, (2) The ammount of failures in consecutive. –  Ricardo Vera Jul 30 '12 at 5:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.