Timeline for Should revisions that contain credentials be deleted?
Current License: CC BY-SA 3.0
7 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Dec 30, 2014 at 1:08 | comment | added | Matt | Gee, it sure would be nice if Stack Overflow had everyone's phone number for those occasions. Besides, you can't compare losing a single physical object to a public page on the Internet that gets seen by people and crawled, archived, replicated by bots. | |
Dec 30, 2014 at 1:06 | comment | added | Ilmari Karonen | Perhaps a real-world analogy might communicate my point better: if you lose your credit card in a public place, even temporarily, you need to call your bank and have them block it ASAP, because someone may have found it and copied the information on it. Even so, would you really appreciate it if some helpful person found your card and decided to spread posters all over town saying "Matt XXX, you lost your credit card # 1234 5678 9012 3456, CVC 123! Please call your bank and have them block it!"? | |
Dec 30, 2014 at 1:02 | comment | added | Matt | No, you must assume they have been. Assuming that publicized credentials are still secret is foolish. | |
Dec 30, 2014 at 0:54 | comment | added | Ilmari Karonen | Of course not, but you can't just assume that they have been, either. Besides, even if they have already been compromised, why would you go around shouting "Hey, anyone else feel like breaking into this guy's server too? Here's the password!" to all the world? | |
Dec 30, 2014 at 0:40 | comment | added | Matt | @IlmariKaronen Doesn't matter. You can't assume that publicly-leaked credentials haven't been compromised. Period. | |
Dec 29, 2014 at 23:59 | comment | added | Ilmari Karonen | Sorry, but I'll have to -1 this. There's always a chance that no malicious person has noticed and exploited the leaked credentials yet -- your suggested banner would pretty much guarantee that someone would. This could easily cause harm to innocent third parties (such as users of a compromised web site) too. Now, if the banner was visible only to the person who posted the credentials, then I could support this (although I still would say that the revision containing the credentials should be hidden, as soon as we become aware of it). | |
Dec 29, 2014 at 22:06 | history | answered | Matt | CC BY-SA 3.0 |