My company recently discovered that we're logging invalid login attempts, alongside with usernames and passwords. Those logfiles are stored on several machines and accessible to all team members. This was of course not our intention (introduced by previous team) and we already patched it.

What are the threats posed by this situation? Should we notify users about that or just remove entries from logs and move on (those were invalid passwords after all)?

Bonus question: How can I convince decision-makers to make the right choice?

  • 1
    With password reuse, and the sentence "accessible to all team members" then yes, I'd argue you do need to inform users. You should also clean logfiles of passwords (or not log invalid password attempts in the first place, at least not somewhere that's accessible). – AlexH Feb 9 '15 at 15:28
  • These invalid login attempts could be some form of the real password, and users should be made aware of this. – RoraΖ Feb 9 '15 at 16:02
  • A bigger question: what do you expect to gain from logging the invalid username/password? Or, to rephrase, why is it not sufficient simply to log "invalid login"? – kdgregory Feb 9 '15 at 19:38
  • 1
    @kdgregory Sorry for the confusion, I thought it was obvious that it was a bug. We already patched it. – joozek Feb 9 '15 at 19:47
  • @joozek - np. That comment was spurred by your question re convincing decision-makers. Which indicated to me that they might have thought that there was some benefit to logging the incorrect values. – kdgregory Feb 9 '15 at 20:24

The threats is that if anybody of the team members is crooked he/she could guess the correct password. Invalid login attempts - it seems to me - are because of 3 reasons:

  1. spelling mistakes for password or user name
  2. wrong password or username
  3. invalid attempts (hitting enter too early, no password at all etc)

Now for the spelling mistake it is very possible that it is easy to guess the password. If the wrong password is used then it may be the password for a different service. So the obvious threat is that anybody that has had access to the logfiles may abuse this information and impersonate somebody.

You can convince decision makers by asking them how they would react if their accounts would be compromised. It would be a bonus for you if you can find an actual account of one of the decision makers and a bad password attempt.

But in the end they are responsible for making the right choice. If they decide just to delete the files then you may protest, but in the end you'll have to decide if your moral obligation to the users weighs more than your job.

Personally I would inform the users, but I don't own a company.


What are the threats posed by this situation?

Threats include information leakage as this info could be in your logs in plaintext:

  • Passwords for other sites or systems.
  • Partially entered passwords for your system.
  • Old, similar passwords.
  • Old passwords that were attempted since password was changed, which may have been reused elsewhere.
  • Passwords with typos for your system.

All stored along with the name of the user account.

Anyone with access (all team members in your case) will be able to read these entries, and if not properly secured the consequences could be worse (as normally passwords should be stored salted and hashed using a slow algorithm to guard against situations where the data is accidentally leaked).

Should we notify users about that or just remove entries from logs and move on (those were invalid passwords after all)?

Definitely. You should inform all users that they need to change their password ASAP. If your system has any password reset functionality then you should use this to temporarily disable all accounts until their password has been changed (details of how to do this depends on the sensitivity of your system - e.g. whether password resets via emailed short term links with random tokens are acceptable).

How can I convince decision-makers to make the right choice?

Explain that unless the company is 100% sure that the log files have not been leaked in any way (either hacked or by an employee on purpose or accidentally), then all accounts are at risk unless passwords are changed.

  • I don't think you can ever be 100% sure about the log files not being leaked. You could however explain to users / managers that the risk of leakage is limited to the amount of people that have access to the log files. Some of those people probably already have the power to compromise the system (for example by replacing or debugging the service or monitoring the network). In the end the data could still be secure. It's a lot better than the many compromised DB stories, but it makes it harder to reach a decision on what to do. In the end it comes down to how much the employees are trusted. – Maarten Bodewes Feb 10 '15 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.