-6

When you put in an incorrect user id and/or password , do companies/websites keep a record of that?

Like for example Joe1 had an incorrect login attempt at this time?

And if so how long do they keep record of that.

|improve this question

closed as off-topic by AffableAmbler, jmoreno, The Wandering Dev Manager, solarflare, gnat Dec 3 '18 at 5:03

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – AffableAmbler, The Wandering Dev Manager
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I'm voting to close this question as off-topic because it belongs on security.se – jmoreno Dec 3 '18 at 1:55
4

This is company dependent, normal security protocols would be 'yes', time could be unlimited it's just a log file. Mine has never been stopped or archived for years. I see what username they attempted with, ip address, the timestamp and the password they tried to use. This is a very basic log. Others are more intricate.

|improve this answer
  • does It make it look suspicious if you keep clicking forgetting password? – Steve P Dec 3 '18 at 0:52
  • 1
    Yes it does, certainly doesn't say anything positive anyway. Not an issue if it's something you rarely log in to. But it would catch my eye if someone was persistently having the issue on a system they use all the time. Depends what it is. – Kilisi Dec 3 '18 at 0:55
  • 1
    This is a good example of how services that don't store your passwords as plain text in the obvious place still end up storing your passwords as plain text in their logs. Don't reuse passwords folks. – Nathan Cooper Dec 3 '18 at 1:23
  • @NathanCooper some do, some don't... mine are closed systems not publicly accessible, didn't bother getting too fancy. Some clients I set up don't store the password attempted, it's all down to the type of security you want to set up. These things are rarely done without putting a bit of thought into it. But I agree, DONT reuse passwords, it makes a single point of failure, never a good idea – Kilisi Dec 3 '18 at 1:25
  • 1
    No, don't use the same password for all the different sites or apps, it means that if someone found out one password, they know them all... single point of failure... lots of people get caught out that way... someone gets their mail password, can access their facebook, other social media, internet banking, paypal etc,. – Kilisi Dec 3 '18 at 1:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.