Thanks for your feedback and support. Your idea indeed sounds interesting for audit purposes. However, this would assume, you will treat all passwords as plaintext since at the moment of login, you don’t know yet if it will fail or pass. Also failures are not necessarily attackers but can be your own users for which you would expose passwords. That is far from best practice and not security by design.
Storing plaintext passwords of failed attempts creates real exposure – both the privacy risk to legitimate users who simply mistyped, and the security risk if the database is ever accessed by someone it shouldn’t be. The diagnostic value doesn’t justify it IMHO.
When I took over the plugin – since I used it myself for years also – we had severe security issues in the code and even a CVE against it. That is now all solved, and we should endeavor to keep the code clean and secure.
Happy to discuss other improvement ideas. You can also contribute to the code directly here: https://github.com/apio-sys/simple-login-log .
Hi! Thanks for the response! It’s been sooo long now, I forget the details of my change. I might have added a column to the failed login table to store the failed password or otherwise grabbed it from the same spot where the login log was getting the data it did store. Regardless, it I think it was being stored in plain text.
Your points about security and spot on, but there’s got to be a way to what the failed attempted passwords were. I mean WordPress rejected the password and there’s just no record of what that “bad” password was. Your point about the database being accessed by an unauthorized party is completely valid. If database access were actually achieved, they would have access to *all* the passwords and then we have a completely different problem to deal with. 🙂 lol
In any event, the only reason I mention this is because I noticed this plugin was recently updated and I had actually completely forgotten about it, until this update. In fact, when I saw it was updated, I was concerned that a “bad actor” had taken control of the plugin and well, you can imagine the rest. 🙂
Anyway, thanks for taking the time to reply. 🙂
You’re welcome & kind regards,
Joris.
