Skip to main content
The 2024 Developer Survey results are live! See the results
82 votes

Should log files be kept secret?

There are clearly 2 different lines of defense here. First, highly sensitive data (secrets, typically passwords) should never be logged to avoid compromise through logs. But the more an attacker ...
Serge Ballesta's user avatar
60 votes
Accepted

How are full URLs exposed when they are encrypted by HTTPS?

The article states that: a connection was discovered to a web filter app built by Conor [Solutions] Given that it was a web filter, and given that it was able to log URLs, we can infer that this ...
gowenfawr's user avatar
  • 73k
56 votes
Accepted

Does Google collect and store data about activity done in Incognito mode?

I think you need to distinguish between "Google" and "Chrome". Chrome is a browser and the main feature of the Incognito mode is to delete any locally stored information from the ...
Steffen Ullrich's user avatar
51 votes

Should Failed Login Attempts Be Logged

Yes, failed login attempts should be logged: You want to know when people are trying to get in You want to understand why your accounts are getting locked out It's also very important - older ...
gowenfawr's user avatar
  • 73k
51 votes
Accepted

Should I log that a user changed their password?

To, answer your question, Yes, you can and SHOULD log password-changes, and there's nothing fundamentally wrong with doing so, as long as you don't e.g. record the password itself" What to log? When ...
Shane Andrie's user avatar
  • 3,840
44 votes
Accepted

Should we keep logs forever to investigate past data breaches?

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
John's user avatar
  • 769
44 votes

How to prevent admins to access logs from their own activity?

The accepted solution to this is to not store the logs locally, but on a log server. Once the logs are there, you can restrict or limit access as you see fit. In some log server/aggregator solutions,...
schroeder's user avatar
  • 131k
44 votes
Accepted

Is displaying email addresses in an application log file allowed under GDPR?

The goal of GDPR is about protecting personally identifiable information (PII) as much as possible. The interaction of a specific user with your application are pretty sure such PII. If you really ...
Steffen Ullrich's user avatar
39 votes

What security risks do you see with wrong OTPs appearing in application logs?

However, they do not want to modify the application code, and are asking me (I have no access to source code) to prove that wrong OTPs in the logs presents security risks. If only OTP's are logged, ...
vidarlo's user avatar
  • 16.7k
32 votes

Is displaying email addresses in an application log file allowed under GDPR?

Logging data is not the issue under GDPR. The part that matters is what happens to the log, who can see it, how long it is stored, what the log is used for, and if you can satisfy the rights of the ...
schroeder's user avatar
  • 131k
29 votes

Should log files be kept secret?

Access to raw log data should be restricted to authorized users. The simple reason for that is that even when under normal operating conditions your applications may should not log any data too ...
HBruijn's user avatar
  • 1,345
23 votes

What security risks do you see with wrong OTPs appearing in application logs?

As well as users accidentally logging passwords as @vidarlo mentioned, I can think of two other potential issues: If a user mis-types their OTP, then what you're logging is a nearly correct OTP, with ...
Gh0stFish's user avatar
  • 13.3k
19 votes

Should log files be kept secret?

It has more points of view: 1) By not hiding logs, you expose your infrastructure. 2) EU has a GDPR. Exposing IP's, names, e-mails or anything personal is prohibited. (and at least immoral and bad ...
Ondřej Kolín's user avatar
16 votes

Should we keep logs forever to investigate past data breaches?

10 Years Storing logs is cheap, more often they're ASCII/UNICODE and easily compressed for long-term archival. Keeping your logs is better than purging for the reasons you can't anticipate. But a ...
123456789123456789123456789's user avatar
14 votes
Accepted

How do I access a firewall log (Windows 10 w. Windows Defender)

Applies to Windows 10 Windows Server 2016 To configure Windows Firewall to log dropped packets or successful connections, use the Windows Firewall with Advanced Security node in the Group Policy ...
TazerFace's user avatar
  • 327
13 votes

Can I trust DNS servers?

No, you can't. It's as easy as you search information about "DNS leak" topic. When you use a VPN, you have the risk of a DNS leak. In other words, your DNS resolution will be made outside your VPN. ...
Rodrigo Calvo's user avatar
13 votes

Apache - strange requests in logs

I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec? What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. ...
Steffen Ullrich's user avatar
12 votes

How to prevent admins to access logs from their own activity?

Any logs on a compromised host are suspect. You need a centralized logging platform, either a central syslog server/ splunk / logrhythm / whatever. Keep a different set of administrators and accounts. ...
Tim Brigham's user avatar
  • 3,792
10 votes

Do XSS attempts leave any trace on the server?

What can the website owner see? Basically everything. If the XSS vector (<script>alert(1)</script> in your case) is part of: - HTTP headers (including cookies) - URL (path, query string)...
Benoit Esnard's user avatar
10 votes

Does Google collect and store data about activity done in Incognito mode?

Advertising vendors can and do keep and collate every bit of information they can, which is a lot, and can (and therefore presumably do) associate your activity in Incognito mode with your other ...
Ben's user avatar
  • 3,737
9 votes

Can I trust DNS servers?

You shouldn't trust them. You may suffer from "DNS Leaking". Ideally, your computer should send DNS Requests through the VPN, but it may request it directly. Your IP address will be exposed. Anyone ...
k9lego's user avatar
  • 151
9 votes

Should Failed Login Attempts Be Logged

As a complement to @gowenfawr's answer that explains why you should log those attempts, I would like to say that there are ways to ensure that logs will never exhaust your disks. At least in the Unix-...
Serge Ballesta's user avatar
9 votes

Should I log that a user changed their password?

I can't give you a reason not to log something; you have to give me a reason why you need to log it. You can theoretically log everything the users does, (down to mouse pointer movement, clicks, and ...
workoverflow's user avatar
8 votes

Is there a place where I can upload my honeypot logs to?

One comment by Luc raises an interesting concern. The problem for any site that would accept honeypot logs is to tell whether you're a trusted source or just full of it. They don't want you to ...
André Borie's user avatar
  • 12.8k
8 votes

Should we keep logs forever to investigate past data breaches?

Storing these log files indefinitely MAY BE illegal in the EU. I am saying MAY BE, since the new data protection legislative comes into effect in May 2018 and there are still some unclear areas. ...
MikiRaven's user avatar
8 votes

Should log files be kept secret?

Even if you don't intentionally log sensitive information, sometimes it can be logged inadvertently. For instance, suppose you log the username of failed logins. Sometimes people accidentally type ...
Barmar's user avatar
  • 594
8 votes

Should log files be kept secret?

The vulnerabilities that may arise from the types of information written to log files is enumerated as CWE-532 in the Common Weakness Enumeration database. Information written to log files can be ...
yourcomputergenius's user avatar
8 votes

Is displaying email addresses in an application log file allowed under GDPR?

Article 5 of GDPR specified the basic principles for processing data. Article 5 "Principles relating to processing of personal data" (1) Personal data shall be: ... (b) collected for ...
Pete's user avatar
  • 191
7 votes

What's the risk if I accidently type my password into a username field in a website?

The greatest risk is if the site logs login attempts based on the username that a user enters, rather than the account. Your password will then be displayed in cleartext in the logs, which may be ...
Ghedipunk's user avatar
  • 6,060
6 votes
Accepted

What should I store in the case that a user posts a threatening post?

I recommend you to log user id and IP each time someone authenticate. That way, if a user post something, you know where it came from. Having a log like that is also useful for other purposes, like ...
lepe's user avatar
  • 2,194

Only top scored, non community-wiki answers of a minimum length are eligible