Hot answers tagged

96

I highly doubt it. You didn't press enter but Google will sometimes send the information to quickly present your results. This is forced over HTTPS. Your information was likely encrypted and not exposed. According to most sources Google processes on average 3.5 billion searches per day. There is no additional information to prove your query is a password. ...


84

There are clearly 2 different lines of defense here. First, highly sensitive data (secrets, typically passwords) should never be logged to avoid compromise through logs. But the more an attacker knows about a system, the higher the risk to build/use a targetted attack. For example software versions are not highly sensitive and can reasonably feed a log, ...


60

The article states that: a connection was discovered to a web filter app built by Conor [Solutions] Given that it was a web filter, and given that it was able to log URLs, we can infer that this was a Man-in-the-Middle (MITM) proxy which decrypted the requests, filtered based on the unencrypted request, and then re-encrypted and forwarded the request to ...


56

I think you need to distinguish between "Google" and "Chrome". Chrome is a browser and the main feature of the Incognito mode is to delete any locally stored information from the browser session after the Incognito mode was closed. The point here is locally stored because this is all the browser can fully control. Google is instead a ...


52

To, answer your question, Yes, you can and SHOULD log password-changes, and there's nothing fundamentally wrong with doing so, as long as you don't e.g. record the password itself" What to log? When designing logging for Security purposes you want to address these questions: When did the event happen? The date and time the event occurred (Use the common ...


50

Yes, failed login attempts should be logged: You want to know when people are trying to get in You want to understand why your accounts are getting locked out It's also very important - older Windows logging process never emphasized this enough - to log successful login attempts as well. Because if you have a string of failed login attempts, you really ...


45

I recommend that you change your password. The fact is, that your password has been sent to their servers, even if you didn't press enter. You can test that on your own, open your browser, Ctrl + Shift + I, select network, start typing and monitor traffic. Here is an example, writing the keyword "test", and not pressing enter. Pay attention to the letter ...


44

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various legal requirements , which vary depending on the nature of the data being stored, as well as the jurisdiction that the data falls under. Retaining log data can ...


44

The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit. In some log server/aggregator solutions, you can limit a user from seeing entries that contain references to certain data (like their user accounts or machine IPs). This means that you can enable ...


40

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge base, or set of documents somewhere that explain your processes and policies. If you don't, be a hero and get started on one. What are the current projects the ...


40

The goal of GDPR is about protecting personally identifiable information (PII) as much as possible. The interaction of a specific user with your application are pretty sure such PII. If you really need to log this information you should inform your user about this process, i.e. the purpose of the data collection, how long the information gets stored and ...


32

The short answer is that it is very, very likely that your concatenated username and password exist on an unencrypted log somewhere that a larger group of people would conceivably have access to than the restricted logs. You are not paranoid to change your password and should change it when this happens.


29

Access to raw log data should be restricted to authorized users. The simple reason for that is that even when under normal operating conditions your applications may should not log any data too sensitive to expose (and opinions/regulations on what that is exactly may differ) there almost certainly will come a time when your logs do contain sensitive data: ...


28

The key word is properly. Properly logging HTTP requests when there is a need for it is not bad practice. I am a pen tester and I log all the HTTP requests that I make as part of a test; doing so is expected. I also work on a server system that integrates with a number of complex legacy systems. Logging full HTTP requests on error is a necessary feature. It ...


28

Logging data is not the issue under GDPR. The part that matters is what happens to the log, who can see it, how long it is stored, what the log is used for, and if you can satisfy the rights of the data subject once you process and store the data. If you need to log the email in order to provide your service, then there is no problem to log it. But if you ...


25

It has been sent (encrypted) to Google. Change your password It has probably been logged somewhere, along with many search terms and other junk people have typed there. While it's unlikely it will be used for anything you care or that endangers your account, why bear the risk? Simply changing it will solve it. PS: I recommend using a browser search bar, ...


19

It has more points of view: 1) By not hiding logs, you expose your infrastructure. 2) EU has a GDPR. Exposing IP's, names, e-mails or anything personal is prohibited. (and at least immoral and bad behaviour) gdpr-info.eu/art-32-gdpr If you need to show the logged data to third party or an easy access use dedicated tool. In my office it's graylog for ...


16

But if this happens my password would be stored in some unencrypted log somewhere, right along with my username. Is this a reasonable concern? Yes. Am I being too paranoid? It depends. If your worry is about the password being stored, then absolutely you're not. Your password will get stored in the clear to a near certainty. Being aware of ...


16

10 Years Storing logs is cheap, more often they're ASCII/UNICODE and easily compressed for long-term archival. Keeping your logs is better than purging for the reasons you can't anticipate. But a minimum, a ten-year retention policy is an industry best practice for US-based businesses since the federal statute of limitations and in most states is a ...


14

This is an entry from my access_log of what my coworker did to my test machine... : 10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/rm -rf /var/www/" In my error log I saw a lot of this: [Thu Sep 25 16:00:00 2014] [error] [client 10.11.12.13] /...


13

The problem with logging everything is not that you could implement it wrong (eg allow XSS, code execution, buffer overflow, etc), because the solution to that would simply be to do it right, as it is with all code. [You do provide an additional attack surface, but if you decide that keeping additional logs is important, that may well be worth it] The ...


12

No, you can't. It's as easy as you search information about "DNS leak" topic. When you use a VPN, you have the risk of a DNS leak. In other words, your DNS resolution will be made outside your VPN. Second, VPN server knows (in some way) who you are, where are you from and where you want to go. It's the same risk that exit nodes of Tor Network pose. ...


12

Applies to Windows 10 Windows Server 2016 To configure Windows Firewall to log dropped packets or successful connections, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in. Administrative credentials To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be ...


12

Any logs on a compromised host are suspect. You need a centralized logging platform, either a central syslog server/ splunk / logrhythm / whatever. Keep a different set of administrators and accounts. That's the whole idea. Once you get a platform in place you can delegate the rights to view their actions, either their own or other admins - can be ...


11

From the access logs of a service (nginx, Dovecot, etc.), you cannot see whether you were affected or not. Unless you have previously captured all SSL traffic, you cannot see whether you got attacked in the past either. The pattern to match in a packet capture is very simple: A malicious Heartbeat request is sent. An overly long Heartbeat response is ...


11

Short answer: they are only able to log the hosts you visit (e.g. security.stackexchange.com, google.com, etc) and not the full address (e.g. https://stackexchange.com/login). If you access unencrypted webpages (http instead of https), they are able to see everything. ISP are not known to log unencrypted webpages en masse, but I wouldn't not be surprised if ...


11

I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec? What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. content type (0x16 = handshake) followed by TLS version (0x0301 = TLS 1.0). Looks like somebody tried to speak HTTPS on port 80 instead of 443.


10

welcome to the intertubes!!! What is the reason behind it? what you see are scans for open proxies, e.g. someone is looking if he/she/it can misuse your server to browse other sites. the first one looks very interesting, because it looks like a scanner; when checking the link (please DONT click on that with a browser), it will give back: <!DOCTYPE ...


10

What can the website owner see? Basically everything. If the XSS vector (<script>alert(1)</script> in your case) is part of: - HTTP headers (including cookies) - URL (path, query string) except the anchor part - POST data (including uploaded files) Then the website owner is able to see it. If your XSS vector is client-side only, then the ...


10

I can't give you a reason not to log something; you have to give me a reason why you need to log it. You can theoretically log everything the users does, (down to mouse pointer movement, clicks, and when a window is the foreground or not). But, do you NEED to log everything? Can you log everything without sacrificing performance? Can you store the logs for ...


Only top voted, non community-wiki answers of a minimum length are eligible