Unitystation: Password shown in plaintext on invalid login attempt

[gardenBanter]

Description

This happens on Linux and I didn't test it on Windows because I don't have Windows. I tried logging in on an alt (I use alts for more character slots, don't judge me!) and messed up a character, and I was shocked to see that the attempted passwords is just dumped into the console in plaintext!

Huge security issue, imagine someone streaming the game in the future, they try to log in, mess up and suddenly on his screen, all viewers see password attempt "TerryPratchrtt1948" and someone figures out the correct password in the blink of an eye.

[RedlineTriad]

Yes, I can confirm that this is currently an issue.
The reason is that it throws an exception on failed login and we catch and log exceptions.
This happens on all platforms but at least it stays local on the computer.

[Necromunger]

we catch and log exceptions.

Can you go into what you mean by that @RedlineTriad ?

Payloads of a login exceptions should never be saved. And your message might highlight a bigger internal issue.

If you are logging exceptions where it that kept? that would highlight that the issue is not local on the computer.

It's on whatever sever exceptions are being sent to.

The plaintext password should be in no system, you just log the endpoint that failed.

[RedlineTriad]

We don't send exceptions anywhere, only to the logs folder on your computer, and yes it is an issue because we shouldn't be logging sensitive information.
It won't be hard to fix, just disable logging for logins.

[NooneAtAll]

shouldn't this issue be closed?