I don’t think that “legal” is the right term to use.

It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password.

Other problem is that people re-use passwords, so they use same password for your site/gmail/facebook/bank. So even if your site doesn’t have sensitive information about users, it’s very possible that getting user’s credentials from your site will let hacker access other user’s accounts (email/CC/bank). And you don’t want to be a source of something like that.

Regards

Aaron

I don’t think that “legal” is the right term to use.

It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password.

Other problem is that people re-use passwords, so they use same password for your site/gmail/facebook/bank. So even if your site doesn’t have sensitive information about users, it’s very possible that getting user’s credentials from your site will let hacker access other user’s accounts (email/CC/bank). And you don’t want to be a source of something like that.