Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
2 typofix
source | link

The reason this is NOT done is easily revealed by looking at what can happen on a site where it IS done.

I was once required to improve the password hash strength of a site which logged bad passwords (for what possible reason they did this, I cannot imagine). To minimize user inconvenience, I first had it auto-convert users as they logged in, but since those who hadn't logged in for some time also needed the improved protection, I tried cracking them, converting all guessed passwords to the higher hashing standard.

After a week of trying everything I knew, known-password lists from large leaks like facebook and so dictionaries of many languages, permutations and so forth, I was left with about 4,000 passwords of people who had not logged in, and which I could not crack.

I took the bad password log for the past several years, used those passwords against the uncrackable passwords, and cracked a quarter of the remainder. That is, it guessed halfquarter of the really hard passwords in the system, including multiple admin accounts, and meaning that I only needed to reset the passwords of 3,000 users, rather than 4,000.

So I think that the value of such a log, to a malicious attacker, cannot be overstated.

There is simply no good, valid reason to log failed passwords, and every reason to avoid diongdoing so - if that data leaks, you have revealed login info for a large swathe of your users. Those "bad passwords" will be passwords they have changed back to, or which they user on other accounts on your system, or which they use on some other system (theritheir bank, their email...)

By keeping such a log, you are endangering your users for no real advantage in security.

The reason this is NOT done is easily revealed by looking at what can happen on a site where it IS done.

I was once required to improve the password hash strength of a site which logged bad passwords (for what possible reason they did this, I cannot imagine). To minimize user inconvenience, I first had it auto-convert users as they logged in, but since those who hadn't logged in for some time also needed the improved protection, I tried cracking them, converting all guessed passwords to the higher hashing standard.

After a week of trying everything I knew, known-password lists from large leaks like facebook and so dictionaries of many languages, permutations and so forth, I was left with about 4,000 passwords of people who had not logged in, and which I could not crack.

I took the bad password log for the past several years, used those passwords against the uncrackable passwords, and cracked a quarter of the remainder. That is, it guessed half of the really hard passwords in the system, including multiple admin accounts, and meaning that I only needed to reset the passwords of 3,000 users, rather than 4,000.

So I think that the value of such a log, to a malicious attacker, cannot be overstated.

There is simply no good, valid reason to log failed passwords, and every reason to avoid diong so - if that data leaks, you have revealed login info for a large swathe of your users. Those "bad passwords" will be passwords they have changed back to, or which they user on other accounts on your system, or which they use on some other system (theri bank, their email...)

By keeping such a log, you are endangering your users for no real advantage in security.

The reason this is NOT done is easily revealed by looking at what can happen on a site where it IS done.

I was once required to improve the password hash strength of a site which logged bad passwords (for what possible reason they did this, I cannot imagine). To minimize user inconvenience, I first had it auto-convert users as they logged in, but since those who hadn't logged in for some time also needed the improved protection, I tried cracking them, converting all guessed passwords to the higher hashing standard.

After a week of trying everything I knew, known-password lists from large leaks like facebook and so dictionaries of many languages, permutations and so forth, I was left with about 4,000 passwords of people who had not logged in, and which I could not crack.

I took the bad password log for the past several years, used those passwords against the uncrackable passwords, and cracked a quarter of the remainder. That is, it guessed quarter of the really hard passwords in the system, including multiple admin accounts, and meaning that I only needed to reset the passwords of 3,000 users, rather than 4,000.

So I think that the value of such a log, to a malicious attacker, cannot be overstated.

There is simply no good, valid reason to log failed passwords, and every reason to avoid doing so - if that data leaks, you have revealed login info for a large swathe of your users. Those "bad passwords" will be passwords they have changed back to, or which they user on other accounts on your system, or which they use on some other system (their bank, their email...)

By keeping such a log, you are endangering your users for no real advantage in security.

1
source | link

The reason this is NOT done is easily revealed by looking at what can happen on a site where it IS done.

I was once required to improve the password hash strength of a site which logged bad passwords (for what possible reason they did this, I cannot imagine). To minimize user inconvenience, I first had it auto-convert users as they logged in, but since those who hadn't logged in for some time also needed the improved protection, I tried cracking them, converting all guessed passwords to the higher hashing standard.

After a week of trying everything I knew, known-password lists from large leaks like facebook and so dictionaries of many languages, permutations and so forth, I was left with about 4,000 passwords of people who had not logged in, and which I could not crack.

I took the bad password log for the past several years, used those passwords against the uncrackable passwords, and cracked a quarter of the remainder. That is, it guessed half of the really hard passwords in the system, including multiple admin accounts, and meaning that I only needed to reset the passwords of 3,000 users, rather than 4,000.

So I think that the value of such a log, to a malicious attacker, cannot be overstated.

There is simply no good, valid reason to log failed passwords, and every reason to avoid diong so - if that data leaks, you have revealed login info for a large swathe of your users. Those "bad passwords" will be passwords they have changed back to, or which they user on other accounts on your system, or which they use on some other system (theri bank, their email...)

By keeping such a log, you are endangering your users for no real advantage in security.