Is it legal to store/log mistyped passwords?
How many of you have seen this happen in a log file or DB?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
I don’t think that “legal” is the right term to use.
It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password.
Other problem is that people re-use passwords, so they use same password for your site/gmail/facebook/bank. So even if your site doesn’t have sensitive information about users, it’s very possible that getting user’s credentials from your site will let hacker access other user’s accounts (email/CC/bank). And you don’t want to be a source of something like that.
As mentioned, it is perfectly legal in many jurisdictions, as the owner of the machine can do what they want with this data (it doesn't count as personal data under most data protection statutes)
But it raises a risk - that the viewer of those logs could build up a good idea of people's passwords, which removes the auditability of actions (they could log in as the individual whose password has been logged) so it would be a very bad idea, and in regulated industries would raise a problem!
Very bad idea indeed. People sometimes enter the password for another site. If that were logged it would be valuable information for anyone you can access the log. One can often guess from a small number of sites for which of these the password is correct.
To add to previous answers, you should not log the username either, it's pretty common that people get "out of sync" and type their password in the login field (bad UI being the main culprit here).
I have seen that not only the password is stored in DataBase, but also the username, so the DBA or someone who has access to the list of log, could imagine the correct credential.
Does this type of log information has worth? IMO no, because it is better in terms of security that the website informs the user with an alert email about "failed logins". The only worth it could have to log that information is to (1) know the pattern that some hacker is trying to use to log in (2) and which user is considering.