96
votes
Accepted
I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?
I highly doubt it.
You didn't press enter but Google will sometimes send the information to quickly present your results. This is forced over HTTPS. Your information was likely encrypted and not ...
- 3,362
84
votes
Should log files be kept secret?
There are clearly 2 different lines of defense here.
First, highly sensitive data (secrets, typically passwords) should never be logged to avoid compromise through logs.
But the more an attacker ...
- 26.5k
60
votes
Accepted
How are full URLs exposed when they are encrypted by HTTPS?
The article states that:
a connection was discovered to a web filter app built by Conor [Solutions]
Given that it was a web filter, and given that it was able to log URLs, we can infer that this ...
- 72.7k
56
votes
Accepted
Does Google collect and store data about activity done in Incognito mode?
I think you need to distinguish between "Google" and "Chrome".
Chrome is a browser and the main feature of the Incognito mode is to delete any locally stored information from the ...
- 199k
52
votes
Accepted
Should I log that a user changed their password?
To, answer your question, Yes, you can and SHOULD log password-changes, and there's nothing fundamentally wrong with doing so, as long as you don't e.g. record the password itself"
What to log?
When ...
- 3,820
51
votes
Should Failed Login Attempts Be Logged
Yes, failed login attempts should be logged:
You want to know when people are trying to get in
You want to understand why your accounts are getting locked out
It's also very important - older ...
- 72.7k
45
votes
I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?
I recommend that you change your password. The fact is, that your password has been sent to their servers, even if you didn't press enter.
You can test that on your own, open your browser, Ctrl + ...
- 10.2k
44
votes
Accepted
Should we keep logs forever to investigate past data breaches?
There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
- 769
44
votes
How to prevent admins to access logs from their own activity?
The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit.
In some log server/aggregator solutions,...
- 128k
43
votes
Accepted
Is displaying email addresses in an application log file allowed under GDPR?
The goal of GDPR is about protecting personally identifiable information (PII) as much as possible. The interaction of a specific user with your application are pretty sure such PII.
If you really ...
- 199k
33
votes
Accepted
Should I be worried if I accidentally entered my password in a username field?
The short answer is that it is very, very likely that your concatenated username and password exist on an unencrypted log somewhere that a larger group of people would conceivably have access to than ...
- 128k
31
votes
Accepted
Why would properly logging full http requests be bad practice?
The key word is properly.
Properly logging HTTP requests when there is a need for it is not bad practice. I am a pen tester and I log all the HTTP requests that I make as part of a test; doing so is ...
- 33.4k
31
votes
Is displaying email addresses in an application log file allowed under GDPR?
Logging data is not the issue under GDPR. The part that matters is what happens to the log, who can see it, how long it is stored, what the log is used for, and if you can satisfy the rights of the ...
- 128k
29
votes
Should log files be kept secret?
Access to raw log data should be restricted to authorized users.
The simple reason for that is that even when under normal operating conditions your applications may should not log any data too ...
- 1,355
25
votes
I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?
It has been sent (encrypted) to Google. Change your password
It has probably been logged somewhere, along with many search terms and other junk people have typed there. While it's unlikely it will be ...
- 18.8k
19
votes
Should log files be kept secret?
It has more points of view:
1) By not hiding logs, you expose your infrastructure.
2) EU has a GDPR. Exposing IP's, names, e-mails or anything personal is prohibited. (and at least immoral and bad ...
- 291
17
votes
Should I be worried if I accidentally entered my password in a username field?
But if this happens my password would be stored in some unencrypted
log somewhere, right along with my username.
Is this a reasonable concern?
Yes.
Am I being too paranoid?
It depends.
If ...
- 22.8k
16
votes
Should we keep logs forever to investigate past data breaches?
10 Years
Storing logs is cheap, more often they're ASCII/UNICODE and easily compressed for long-term archival.
Keeping your logs is better than purging for the reasons you can't anticipate.
But a ...
14
votes
Why would properly logging full http requests be bad practice?
The problem with logging everything is not that you could implement it wrong (eg allow XSS, code execution, buffer overflow, etc), because the solution to that would simply be to do it right, as it is ...
- 29.5k
14
votes
Accepted
How do I access a firewall log (Windows 10 w. Windows Defender)
Applies to
Windows 10
Windows Server 2016
To configure Windows Firewall to log dropped packets or successful connections, use the Windows Firewall with Advanced Security node in the Group Policy ...
- 327
13
votes
Can I trust DNS servers?
No, you can't.
It's as easy as you search information about "DNS leak" topic. When you use a VPN, you have the risk of a DNS leak. In other words, your DNS resolution will be made outside your VPN.
...
- 141
13
votes
Apache - strange requests in logs
I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec?
What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. ...
- 199k
12
votes
How to prevent admins to access logs from their own activity?
Any logs on a compromised host are suspect. You need a centralized logging platform, either a central syslog server/ splunk / logrhythm / whatever. Keep a different set of administrators and accounts. ...
- 3,782
10
votes
Do XSS attempts leave any trace on the server?
What can the website owner see?
Basically everything.
If the XSS vector (<script>alert(1)</script> in your case) is part of:
- HTTP headers (including cookies)
- URL (path, query string)...
- 14.7k
10
votes
Does Google collect and store data about activity done in Incognito mode?
Advertising vendors can and do keep and collate every bit of information they can, which is a lot, and can (and therefore presumably do) associate your activity in Incognito mode with your other ...
- 3,737
9
votes
Accepted
Logging sensitive data
My bank's android app is logging session ids, account numbers, money transfers and current balance of my account.
If true, what bank? Shame them. It's also possible you have a piece of malware that'...
- 22.6k
9
votes
Can I trust DNS servers?
You shouldn't trust them. You may suffer from "DNS Leaking". Ideally, your computer should send DNS Requests through the VPN, but it may request it directly. Your IP address will be exposed. Anyone ...
- 151
9
votes
Should Failed Login Attempts Be Logged
As a complement to @gowenfawr's answer that explains why you should log those attempts, I would like to say that there are ways to ensure that logs will never exhaust your disks.
At least in the Unix-...
- 26.5k
9
votes
Should I log that a user changed their password?
I can't give you a reason not to log something; you have to give me a reason why you need to log it.
You can theoretically log everything the users does, (down to mouse pointer movement, clicks, and ...
- 231
8
votes
Accepted
Is logging a hashed password safe?
Is logging a hashed password safe?
Do not do this.
Unless you protect your logs to the same degree as your database (which would be very unusual and probably difficult) you will be weakening your ...
- 8,494
Only top scored, non community-wiki answers of a minimum length are eligible