The tag has no wiki summary.

learn more… | top users | synonyms

23
votes
5answers
1k views

Should passwords be revealed in error message?

I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
15
votes
3answers
1k views

Is it a vulnerability to display exception messages in an error page?

Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display ...
10
votes
4answers
543 views

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
8
votes
3answers
830 views

Is a stack trace of a server application a vulnerability?

In relation to my question on programmers.stackexchange.com. Is it a security risk to have your application display a full stack trace to the user when things crash? Some security audit that our ...
8
votes
4answers
496 views

What information should a error log record?

I want to populate my error log with useful information if and when errors occur. I'd like to use the log to be able to spot and fix bugs on my site, but also to potentially log hack attempts. For a ...
4
votes
3answers
277 views

February 7th 2013 Facebook integration error implications [duplicate]

What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last ...
3
votes
2answers
262 views

Do LAMP log files sometimes contain sensitive information?

I will have a LAMP web server with CentOS and cPanel. With this setup, is it possible for any server log files, whether regular or error logs, to contain sensitive information in them, such as ...
2
votes
8answers
413 views

Finding Hidden Keylogger Through Forcing a Computation Error

It must be possible to detect keylogging by close scrutiny of timing between physical keystroke execution and the character's eventual occurrence on the screen. I've had a friend show me this with ...