search

theyosh / TerrariumPI

Home automated terrarium/aquarium or other enclosed environment with a Raspberry Pi
https://terrarium.theyosh.nl
GNU General Public License v3.0
402 stars 97 forks source link

[FEATURE]: Obfuscate password attempts in logs #909

Closed cyber-shifter closed 2 months ago

cyber-shifter commented 2 months ago

I'm not sure if anyone has thought about this or not, but I noticed this when looking for some other information in the logs. When you fail to log in with an administrator account to TerrariumPi, it puts the "password" that was used for the attempt in plain text, in the logs. Obviously whether or not this represents sensitive information depends on your personal stance and experience. As someone who works in IT every day, this isn't something I would like my devices doing. But I'm also a bit paranoid about IoT devices. So I wanted to just start the conversation about it I guess.

theyosh commented 2 months ago

Euh, it should NOT be logged. So I will have a look into that.

My goal is NOT to log sensitive data.

cyber-shifter commented 2 months ago

Oh! Well! I'm glad I said something. I wasn't going to originally.

theyosh commented 2 months ago

Done!. It now logs stars.

cyber-shifter commented 2 months ago

Excellent!! My paranoid IT brain can rest easier.