Get the latest tech news
Keeping secrets out of logs (2024)
There's no silver bullet, but if we put some "lead" bullets in the right places, we have a good shot at keeping sensitive data out of logs.
I completely made up this phrase, but the idea is that secrets are coupled to, embedded into, and baked into more general formats like URLs or remote procedure calls. I think a better alternative to a global sample rate is to aggregate logs by some heuristic like type or origin, and to ensure you hit some minimum threshold. I highly recommend going through an exercise like this, because not only does it force you to understand the flows and boundaries of the system, if you spend time at each node and threat model it, you end up finding a bunch of unexpected ways and places that secrets make it into logs.
Or read this on Hacker News
