It's a reasonable point.
Though in a way it does sound like a solution looking for a problem.
Though in a way it does sound like a solution looking for a problem.
Now, of course, I do reuse. But other than the above I just don't see a solution to this particular problem. Filtering both the username and password in the logs? It wouldn't make -me- feel any safer when I log onto that Xbox hacker forum. I worry about the administrator of the site having access to my passwords. Not any possible hackers that might wander by.
PS. There are tools out there that will fill in username and password depending on URL. Of course, that gives another attack vector...
The thing is that working as a hacker (white hat) has made me actually less worried about my bad security habits.
It's like real life. If your sane in your habits and stay alert not much is likely to happen.
It's like insurance. You only insure as much as you feel is at potential risk; once the cost of insurance outweighs the risk you (should) stop paying.
Same with your passwords; the risk of losing them is fairly minimal. If someone wants to get them really bad they will do, not a lot you can ultimately do to stop them. Reasonable vigilance should be enough to keep you secure.
(and by that I mean having enough sense that when XYZ site's password database is compromised you change things etc.)
And now that I read back my comment, it kind of looks as if I was just trying to take a cheap stab at your comment. It wasn't the case. I genuinely spent a moment to think about whether there would be a viable solution to the problem at this level. :) Now, getting rid of passwords altogether...
(I dislike people who say you can't solve this -- and here I go doing it myself!)