My favorite was responding to SMS bots https://twitter.com/infosecatom/status/1469774771634249740?s...
back
1 comments
Just read through some of that. My favorite response: "Is it wrong to use a log4j exploit as a password?
I mean, passwords shouldn't be coming anywhere near logging code... right?"
How many times have we heard of raw text passwords being saved in logs?
Only once. At Facebook: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...
...and you can assume that for every case you hear of, there are at least 50 that you didn't hear of, because if you do end up logging passwords, it's something you're likely to want to keep under wraps if possible.
I knew it was definitely more than once. If it gets done at places like FB & G, then you know other smaller places are doing/have done it as well. They just didn't make the news, nor know it isn't a bad thing.
I mean, what if we have to troubleshoot an issue that is due to, say, the character encoding of such password? We need to see it, right?
(yes, such an issue would likely indicate you're not handling that sort of data in the right way, but fixing that would probably take three weeks and the PM is screaming FIXITNAOO because the customer is on the phone...)
(I'm not condoning this, just saying that it can look sensible at the time)
No. Just NO NO NO. Passwords should be treated as sacrosanct. There are other ways of testing encoding. Looking at someone's password should be anathema to anyone. That's like wearing mirrors on your shoes trying to look up places one shouldn't be looking. It's just naughty to the point that any normal person would think it wrong to be doing it. Those kind of requests should actually be reported immediately. Stand up for yourself, for your fellow devs, for 'all humankind' and tell that PM making the request to pound sand (politely). If still pushed, go report them to the next rung up. "Because orders" is not a valid excuse.
Even for a honeypot?