Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Let's say I typed my password into the username textbox of a frequently-visited website (https of course) and hit enter before I noticed what I was doing.

Is my password now sitting in plaintext in a log file somewhere? How could my mistake be exploited by a crafty miscreant? Help me understand the factual security implications regardless of the likelihood of it actually happening.

share|improve this question
4  
I don't understand why this question is flagged as "opinion-based". It clearly asks "What are the security implications" which can be (and is, given at least the accepted answer) backed-up by facts. –  Calimo Feb 14 at 9:18
    
This is on-topic on security.stackexchange.com –  kinokijuf Feb 14 at 9:35
    
@kinokijuf: Certainly I considered that first, however Information Security Stack Exchange is a question and answer site for Information security professionals. I'm not one, and I don't think we need one to answer this question. I made a mistake that any user could make, and I think the answers are interesting to users, not security professionals. However I could certainly be wrong. –  agentnega Feb 14 at 9:57
    
You're right, it should have been closed as "too broad" –  random Feb 14 at 17:07
add comment

2 Answers

up vote 17 down vote accepted

It depends on configuration of authentication system of the site. If it was setup to log any attempts - than yes, it is now in the log (text file or database) in plain text. It could look like that:

12-Feb-2014 12:00:00 AM: Unsuccessful login attempt user (YOUR_PASSSORD_HERE) from (YOUR_IP_HERE);

or similar.

It is still true that password will not be accessible for regular users. Only for those who have access to log files.

What consequences it implies?

  • If server would be compromised - than hacker theoretically will have your plain text password.
  • Site's admin could routinely go thru the log files and accidentally find your password. He can than find what IP address this record came from and thus he can theoretically find what is your username and e-mail (because he has access to the database).

So, if you have same email/username/password on other resources - than change it immediately. Because there are chances that your password will be found. Logs can remain on servers for years.

share|improve this answer
8  
There may be a local record of your attempt as well. Many (most?) browsers have an Autofill feature that's enabled by default and saves certain form entries - username, email address, phone#, etc. - for your convenience. If you open the login page again, click on the username field and press the down arrow key you may see your password listed along with username(s). You can delete it from the list, however, to be absolutely safe it would be best to change your password as suggested above. –  gm2 Feb 13 at 18:00
add comment

Just as you said, webaplications tend to keep logs of unsucessful logins attempts. If someone would be looking through the logs, he can connect this particular login attempt with your another, successful attempt (i.e. via IP adress).

Though I do not think this is likely to happen, you can always change it be sure.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.