Сервис GitHub разослал некоторым своим пользователям предупреждение о том, что их пароли в открытом виде попали в системные журналы сервиса и некоторые сотрудники GitHub могли получить к ним доступ. Пользователям предлагается сменить пароли.
Текст письма:
During the course of regular auditing, GitHub discovered that a recently introduced bug exposed a small number of users’ passwords to our internal logging system, including yours. We have corrected this, but you'll need to reset your password to regain access to your account.
GitHub stores user passwords with secure cryptographic hashes (bcrypt). However, this recently introduced bug resulted in our secure internal logs recording plaintext user passwords when users initiated a password reset. Rest assured, these passwords were not accessible to the public or other GitHub users at any time. Additionally, they were not accessible to the majority of GitHub staff and we have determined that it is very unlikely that any GitHub staff accessed these logs. GitHub does not intentionally store passwords in plaintext format. Instead, we use modern cryptographic methods to ensure passwords are stored securely in production. To note, GitHub has not been hacked or compromised in any way.
Надо сказать, что логгирование ввода пароля пользователя это абсолютно порочная практика. Кстати, как и перехват паролей к различным сервисам (вроде Gmail и т.п.) в доморощенных российских DLP-системах. 😎
Про утечки через GitHub мы писали в отдельной статье: https://www.devicelock.com/ru/blog/utechki-cherez-github.html
Текст письма:
During the course of regular auditing, GitHub discovered that a recently introduced bug exposed a small number of users’ passwords to our internal logging system, including yours. We have corrected this, but you'll need to reset your password to regain access to your account.
GitHub stores user passwords with secure cryptographic hashes (bcrypt). However, this recently introduced bug resulted in our secure internal logs recording plaintext user passwords when users initiated a password reset. Rest assured, these passwords were not accessible to the public or other GitHub users at any time. Additionally, they were not accessible to the majority of GitHub staff and we have determined that it is very unlikely that any GitHub staff accessed these logs. GitHub does not intentionally store passwords in plaintext format. Instead, we use modern cryptographic methods to ensure passwords are stored securely in production. To note, GitHub has not been hacked or compromised in any way.
Надо сказать, что логгирование ввода пароля пользователя это абсолютно порочная практика. Кстати, как и перехват паролей к различным сервисам (вроде Gmail и т.п.) в доморощенных российских DLP-системах. 😎
Про утечки через GitHub мы писали в отдельной статье: https://www.devicelock.com/ru/blog/utechki-cherez-github.html
