2026-09-07 15:56 UTC
@SpaceLifeForm@infosec.exchange @jerry@infosec.exchange That's a good way to get passwords recorded in clear in your logs, that is. "Failed login attempt from user [password], password redacted".
Replies (1)
-
@SpaceLifeForm@infosec.exchange 2026-09-07 22:27
@TimWardCam@c.im @jerry@infosec.exchange True. I did say it was tricky. If what ends up in the username field is not a valid username, then just log a failed attempt with the ip address but not the username field. The problem could happen today, just via simple user error. The logs will look fine if your password is the same as your username, such as admin/admin. /s