如果在使用者名稱欄位中提交密碼，會帶來什麼安全隱患？

假設你有一個糟糕的一天，急於登入到一個喜愛的網站，然後意外地提交您的密碼在使用者名稱文字框代替。你應該擔心並更改你的網站密碼，還是隻是毫無根據的恐懼？...

假設你有一個糟糕的一天，急於登入到一個喜愛的網站，然後意外地提交您的密碼在使用者名稱文字框代替。你應該擔心並更改你的網站密碼，還是隻是毫無根據的恐懼？

今天的問答環節是由SuperUser提供的，SuperUser是Stack Exchange的一個分支，是一個由社群驅動的問答網站分組。

問題

超級使用者閱讀器agentnega想知道在使用者名稱文字框中鍵入密碼並意外提交密碼會有什麼危險：

Let’s say I typed my password into the username text box of a frequently-visited website (https of course) and hit enter before I noticed what I was doing.

Is my password now sitting in plain text in a log file somewhere? How could my mistake be exploited by a crafty miscreant? Help me understand the actual security implicati*** regardless of the likelihood of it actually happening.

這真的是一個值得擔心的問題嗎，或者你能把它看作一個簡單的錯誤而忘記它嗎？

答案

超級使用者貢獻者Nikolay和GregD為我們提供了答案。首先，尼古拉：

It depends on the configuration of the authentication system for the website. If it was setup to log any attempts, then yes, it is now in the log (text file or database) in plain text. It could look like this:

12-Feb-2014 12:00:00 AM: Unsuccessful login attempt user (YOUR_PASSSORD_HERE) from (YOUR_IP_HERE);

or similar.

It is still true that a password will not be accessible for regular users, only for those who have access to log files.

What c***equences does it imply?

If the server was ever compromised, then theoretically, the hacker would have your plain text password.
The website’s administrator could routinely go through the log files and accidentally find your password. He can then find the IP address this record came from, and thus he can theoretically find out what your username and e-mail are (because he has access to the database).

So, if you use the same e-mail/username/password on other websites, then change it immediately. Because there is always a chance that your password will be found out. Logs can remain on servers for years.

接著是格雷格的回答：

Just as you said, web applicati*** tend to keep logs of unsuccessful login attempts. If someone were to look through the logs, he could connect this particular login attempt with one of your successful attempts (i.e. via IP address).

Though I do not think this is likely to happen, you can always change it be sure.

隨著這些天來我們讀到和聽到的大量資料洩露，最好是更改有關網站的密碼（以及任何其他具有相同密碼的網站），以使您安心。當涉及到你的線上帳戶的安全性時，安全總比抱歉好！

有什麼要補充的解釋嗎？在評論中發出聲音。想從其他精通技術的Stack Exchange使用者那裡瞭解更多答案嗎？在這裡檢視完整的討論主題。