6 ms·

Actually, we ding you for putting sensitive information in URLs that are used in a browser. The reason is that it will then be sent to other sites in the refer

Actually, we ding you for putting sensitive information in URLs that are used in a browser. The reason is that it will then be sent to other sites in the referrer header. When it is used for an API it doesn't matter. A security audit will check that logs are not logging sensitive information or that they are properly secured and encrypted if they do contain such information. The combination of telling users to put their password into the url and logging the url would be a problem, but not either thing on its own.

tptacek 15y ago
No, SomeOtherGuy. This is an HTTPS site. The referer header does not behave the way you're implying it does on HTTPS sites. And having read and written this particular audit line item about 29074894389734897 times in the last 15 years, let me assure you that logging is clearly an issue. The bit about how "if someone can see your logs you're already boned" is also message-board-logic more than reality. Logs are shipped all over the place. On a network pentest, one of the things you do when you pop a box is hunt for logs; even after you get root on the machine, you don't automatically have all the passwords that get stuck in the log files. Same goes for all the random LogLogic-style consoles those logs get fed to. If you have more questions about this stuff, my contact info is in my profile --- just click my username above this comment. I just wanted to chime in to say that 'carbocation was exactly right, but my comments are now repeating themselves, and so I'm done on this thread.
- SomeOtherGuy2 15y ago
  >And having read and written this particular audit line item about 29074894389734897 times in the last 15 years, let me assure you that logging is clearly an issue. Which is what I said. Logging sensitive info is an issue. Not requesting info that could be logged if you were using default settings. You will get dinged for logging sensitive info, you can either not have the info in the query, or not log the query. Either is fine. >The bit about how "if someone can see your logs you're already boned" is also message-board-logic more than reality. No it isn't. If you can read the logs, you are already either the httpd user or root. Hence you don't need application usernames and passwords anymore, you can just go right ahead and do whatever you like. >Logs are shipped all over the place. Wait, I thought we weren't doing things that a security audit will catch? Why did you change your mind now that is convenient? Rather than considering theoretical "what if they are absolutely retarded and send my username and password in the logs in plain text to internet accessible log storage servers?", why not consider the reality that if they are that stupid, they will be compromised anyways. So what is the concern here? As a user of their system, I know they are either doing things right and I am fine, or doing things wrong I and I am boned. So, exactly what we knew before the whole GET vs POST debate. Very helpful. If they are idiots, then there is nothing I can do to secure my account with them, this is why we don't use the same password for multiple services. >If you have more questions about this stuff, my contact info is in my profile --- just click my username above this comment I would suggest that you read the posting guidelines.

tptacek 15y ago

No, SomeOtherGuy. This is an HTTPS site. The referer header does not behave the way you're implying it does on HTTPS sites. And having read and written this particular audit line item about 29074894389734897 times in the last 15 years, let me assure you that logging is clearly an issue. The bit about how "if someone can see your logs you're already boned" is also message-board-logic more than reality. Logs are shipped all over the place. On a network pentest, one of the things you do when you pop a box is hunt for logs; even after you get root on the machine, you don't automatically have all the passwords that get stuck in the log files. Same goes for all the random LogLogic-style consoles those logs get fed to. If you have more questions about this stuff, my contact info is in my profile --- just click my username above this comment. I just wanted to chime in to say that 'carbocation was exactly right, but my comments are now repeating themselves, and so I'm done on this thread.

SomeOtherGuy2 15y ago
>And having read and written this particular audit line item about 29074894389734897 times in the last 15 years, let me assure you that logging is clearly an issue. Which is what I said. Logging sensitive info is an issue. Not requesting info that could be logged if you were using default settings. You will get dinged for logging sensitive info, you can either not have the info in the query, or not log the query. Either is fine. >The bit about how "if someone can see your logs you're already boned" is also message-board-logic more than reality. No it isn't. If you can read the logs, you are already either the httpd user or root. Hence you don't need application usernames and passwords anymore, you can just go right ahead and do whatever you like. >Logs are shipped all over the place. Wait, I thought we weren't doing things that a security audit will catch? Why did you change your mind now that is convenient? Rather than considering theoretical "what if they are absolutely retarded and send my username and password in the logs in plain text to internet accessible log storage servers?", why not consider the reality that if they are that stupid, they will be compromised anyways. So what is the concern here? As a user of their system, I know they are either doing things right and I am fine, or doing things wrong I and I am boned. So, exactly what we knew before the whole GET vs POST debate. Very helpful. If they are idiots, then there is nothing I can do to secure my account with them, this is why we don't use the same password for multiple services. >If you have more questions about this stuff, my contact info is in my profile --- just click my username above this comment I would suggest that you read the posting guidelines.