Hot answers tagged

96 votes
Accepted

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

I highly doubt it. You didn't press enter but Google will sometimes send the information to quickly present your results. This is forced over HTTPS. Your information was likely encrypted and not ...
  • 3,340
84 votes

Should log files be kept secret?

There are clearly 2 different lines of defense here. First, highly sensitive data (secrets, typically passwords) should never be logged to avoid compromise through logs. But the more an attacker ...
60 votes
Accepted

How are full URLs exposed when they are encrypted by HTTPS?

The article states that: a connection was discovered to a web filter app built by Conor [Solutions] Given that it was a web filter, and given that it was able to log URLs, we can infer that this ...
  • 72k
56 votes
Accepted

Does Google collect and store data about activity done in Incognito mode?

I think you need to distinguish between "Google" and "Chrome". Chrome is a browser and the main feature of the Incognito mode is to delete any locally stored information from the ...
52 votes
Accepted

Should I log that a user changed their password?

To, answer your question, Yes, you can and SHOULD log password-changes, and there's nothing fundamentally wrong with doing so, as long as you don't e.g. record the password itself" What to log? When ...
  • 3,780
51 votes

Should Failed Login Attempts Be Logged

Yes, failed login attempts should be logged: You want to know when people are trying to get in You want to understand why your accounts are getting locked out It's also very important - older ...
  • 72k
45 votes

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

I recommend that you change your password. The fact is, that your password has been sent to their servers, even if you didn't press enter. You can test that on your own, open your browser, Ctrl + ...
  • 10k
44 votes
Accepted

Should we keep logs forever to investigate past data breaches?

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
  • 769
44 votes

How to prevent admins to access logs from their own activity?

The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit. In some log server/aggregator solutions,...
  • 124k
41 votes
Accepted

Is displaying email addresses in an application log file allowed under GDPR?

The goal of GDPR is about protecting personally identifiable information (PII) as much as possible. The interaction of a specific user with your application are pretty sure such PII. If you really ...
40 votes
Accepted

What questions should be asked when joining a new security team?

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge ...
32 votes
Accepted

Should I be worried if I accidentally entered my password in a username field?

The short answer is that it is very, very likely that your concatenated username and password exist on an unencrypted log somewhere that a larger group of people would conceivably have access to than ...
  • 124k
30 votes

Is displaying email addresses in an application log file allowed under GDPR?

Logging data is not the issue under GDPR. The part that matters is what happens to the log, who can see it, how long it is stored, what the log is used for, and if you can satisfy the rights of the ...
  • 124k
29 votes
Accepted

Why would properly logging full http requests be bad practice?

The key word is properly. Properly logging HTTP requests when there is a need for it is not bad practice. I am a pen tester and I log all the HTTP requests that I make as part of a test; doing so is ...
  • 32.7k
29 votes

Should log files be kept secret?

Access to raw log data should be restricted to authorized users. The simple reason for that is that even when under normal operating conditions your applications may should not log any data too ...
  • 1,345
25 votes

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

It has been sent (encrypted) to Google. Change your password It has probably been logged somewhere, along with many search terms and other junk people have typed there. While it's unlikely it will be ...
  • 17.6k
19 votes

Should log files be kept secret?

It has more points of view: 1) By not hiding logs, you expose your infrastructure. 2) EU has a GDPR. Exposing IP's, names, e-mails or anything personal is prohibited. (and at least immoral and bad ...
17 votes

Should I be worried if I accidentally entered my password in a username field?

But if this happens my password would be stored in some unencrypted log somewhere, right along with my username. Is this a reasonable concern? Yes. Am I being too paranoid? It depends. If ...
  • 22.5k
16 votes

Should we keep logs forever to investigate past data breaches?

10 Years Storing logs is cheap, more often they're ASCII/UNICODE and easily compressed for long-term archival. Keeping your logs is better than purging for the reasons you can't anticipate. But a ...
14 votes

What do shellshock attacks look like in system logs?

This is an entry from my access_log of what my coworker did to my test machine... : 10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"...
  • 7,535
13 votes

Why would properly logging full http requests be bad practice?

The problem with logging everything is not that you could implement it wrong (eg allow XSS, code execution, buffer overflow, etc), because the solution to that would simply be to do it right, as it is ...
  • 29k
13 votes

Can I trust DNS servers?

No, you can't. It's as easy as you search information about "DNS leak" topic. When you use a VPN, you have the risk of a DNS leak. In other words, your DNS resolution will be made outside your VPN. ...
13 votes
Accepted

How do I access a firewall log (Windows 10 w. Windows Defender)

Applies to Windows 10 Windows Server 2016 To configure Windows Firewall to log dropped packets or successful connections, use the Windows Firewall with Advanced Security node in the Group Policy ...
  • 317
12 votes

Apache - strange requests in logs

I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec? What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. ...
12 votes

How to prevent admins to access logs from their own activity?

Any logs on a compromised host are suspect. You need a centralized logging platform, either a central syslog server/ splunk / logrhythm / whatever. Keep a different set of administrators and accounts. ...
  • 3,762
11 votes

What can my ISP see in their log files if I use Google DNS?

Short answer: they are only able to log the hosts you visit (e.g. security.stackexchange.com, google.com, etc) and not the full address (e.g. https://stackexchange.com/login). If you access ...
  • 511
10 votes

Do XSS attempts leave any trace on the server?

What can the website owner see? Basically everything. If the XSS vector (<script>alert(1)</script> in your case) is part of: - HTTP headers (including cookies) - URL (path, query string)...
10 votes

Should I log that a user changed their password?

I can't give you a reason not to log something; you have to give me a reason why you need to log it. You can theoretically log everything the users does, (down to mouse pointer movement, clicks, and ...
10 votes

Does Google collect and store data about activity done in Incognito mode?

Advertising vendors can and do keep and collate every bit of information they can, which is a lot, and can (and therefore presumably do) associate your activity in Incognito mode with your other ...
  • 3,707
9 votes
Accepted

Logging sensitive data

My bank's android app is logging session ids, account numbers, money transfers and current balance of my account. If true, what bank? Shame them. It's also possible you have a piece of malware that'...
  • 22.5k

Only top scored, non community-wiki answers of a minimum length are eligible