Hacker News Reader

Comment by taurath | Hacker News Reader

Which is the NUMBER ONE MOST BASIC rule of handling users confidential data. It reflects incredibly poorly on the engineering practices of Facebook that this managed to get through. It should be a criminal liability.

View on HN

I'm not arguing this wasn't a bad thing but comment made it sound like they were storing plaintext passwords in the database circa 2002.

Storing them in logs is the same thing IMO. Logs are usually more easily accessible than a user database.

Gonna have to disagree.

I think it would be way worse if we found out they were storing passwords were plaintext in the database in 2019. Even if the security implications are the same/worse, the policy/decision making of such a revelation would be beyond terrible.

edit: To put it another way, remote code execution flaws are terrible but they can happen. However it would be way worse if someone put in a static username/password backdoor. The security outcome may be the same but one is beyond terrible policy/decision making.

As is the policy/decision making that results in logs having the passwords - you can still have very locked down database access. Logs tend to get spread around all sorts of systems, and access control for logs is almost ALWAYS lower than DB keys. They're also cached for search-ability on any number of elasticsearch or business intelligence platforms, so getting rid of them after the fact is even harder. At the very least its an equivalent problem.

Logs tend to be ephemeral with limited retention.

Reply on news.ycombinator.com