View Single Post
allnameswereout's Avatar
Posts: 3,397 | Thanked: 1,212 times | Joined on Jul 2008 @ Netherlands
#102
Originally Posted by qole View Post
On a related note... I just checked; Modest and all of the RTComm accounts (except Skype) still store all the passwords in plain text in GConf. It is trivial for any app to obtain these passwords at the moment.

Should I file bug(s) about this?
Basically, no. It is architectural design, and the proposed solution is snake oil.

Plain text storage of password works as intended because somehow these passwords are stored and encrypted without user interaction because the user chose to save the password. What Skype does is obfuscate the password.

What should happen is this:
Barrier -> Authentication attempt (using input data; e.g. fysical key, smartcard, password, fingerprint, etc)-> Encrypt authentication -> Compare with saved key -> If match, authentication succeeded.

Then stop. However what happens is that after the above the input data is stored. If you provide one this input data they have access. Its like giving away your password.

Now, Skype obfuscates, because it is not known in which format Skype saves it. But if Skype can somehow decrypt the data without input data then so can someone else; they just need to figure out what.

Without obfuscation saving your password is akin to putting your house key before your door and then assume nobody will use it, or whine when someone does use it.

With obfuscation its akin to hiding your key in one of your plants in the front garden which supposedly nobody knows except a determined attacker can easily figure out about this.

This provides a false sense of security; snake oil.

Early UNIX versions did the very same thing, and together with lack of shadow file this made password cracking easy because /etc/passwd was readable by everyone.

If your application can read your program's configuration file and abuses this (arguably misplaced) trust you have worse problems. However, non-hostile applications do not do this.

If people dislike this they should use some form of authentication or a keyring like GNOME Keyring or KeePassX. This is pretty neat however a hostile application can ofcourse work around this.

IOW if this is an issue your solution should be dealing with core issue; hence, a rather architectural change. For example, applications isolated from each other. Then you get to levels such as privilege separation, VMs, ACLs, or microkernel + capability-based security. We do know Nokia is working on a framework to provide some of these mentioned features, but they won't be for Fremantle. Hence 'fixed in Harmattan' or WONTFIX seems rather a likely outcome.
__________________
Goosfraba! All text written by allnameswereout is public domain unless stated otherwise. Thank you for sharing your output!
 

The Following User Says Thank You to allnameswereout For This Useful Post: