Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Authentication configurations expose passwords #1984

Open
haraldsteinlechner opened this issue Oct 27, 2016 · 4 comments
Open

Authentication configurations expose passwords #1984

haraldsteinlechner opened this issue Oct 27, 2016 · 4 comments

Comments

@haraldsteinlechner
Copy link
Contributor

Description

Exceptions and their stdout might print passwords in plaintext

Repro steps

I have no repro steps, the print occured on one of our managers computer and leaked his password to me.

Expected behavior

do not print plaintext password in exception texts

Known workarounds

I suspect the complete plaintext authentication sheme is not really secure. Still, having plaintext passwords printed to screen renders paket really untrustworthy ;)

I'd suggest simply to put StructuredFormatDisplay to authenication configs.

@haraldsteinlechner
Copy link
Contributor Author

i think this might be the right location #1985

@cdrnet
Copy link
Member

cdrnet commented Oct 27, 2016

We seem to run into this from time to time, see also #1224, #1357. Maybe it's time to consider switching to SecureString to prevent this from happening in the first place?

@haraldsteinlechner
Copy link
Contributor Author

1

@cdrnet
Copy link
Member

cdrnet commented Oct 27, 2016

(kind of fitting that this issue has id 1984...)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants