Trello Desktop Application Stores Authentication Token in Plain Text • Hacker News Board

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#21

Post by floatingatoll » Wed, Jul 03, 2019, 7:32 PM UTC

andrewflnr wrote: post #12

I'm planning an offline-capable PWA, and I've spent a fair bit of time worrying about how to store credentials/tokens for my pouchdb backend. Is there, in fact, an established best practice for this? I looked, but couldn't find anything compelling.

Either your application requires an in-memory-only decryption password at each start, or it requires a plaintext cached-on-disk decryption password for headless startup, or it requires a hardware security module (HSM) through which all encrypted storage requests are routed for decryption.

Encrypted filesystems are necessary for #2 to be safe, but merely move the problem of #1 up one step in the chain to OS boot rather than app boot. #3 isn't necessarily safe as the HSM could be used to decrypt data when an attacker has gained access and is undiscovered, unless you use it to issue a temporary decryption key at OS/app boot, at which point you're effectively back to #1 again.

In practice, if you're a server application author, either use the secure credentials storage service offered by your cloud provider or store your secure tokens encrypted on-disk with the decryption key either stored in a local config file elsewhere or entered at app startup.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#22

Post by orliesaurus » Wed, Jul 03, 2019, 7:33 PM UTC

The real question is - how do you handle this in any electron app? Anyone who can access your laptop/computer will be able to retrieve that token because the token needs to be stored somewhere! Has anyone implemented this before and how did you implement it?

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#23

Post by greenpizza13 » Wed, Jul 03, 2019, 7:36 PM UTC

I suppose the reason this token is not encrypted is because supporting offline data access would mean there's some private key on the computer -- and the same read access that exposed this token would expose that key.

Is the Trello offline data at rest encrypted in any way?

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#24

Post by dullgiulio » Wed, Jul 03, 2019, 7:40 PM UTC

skybrian wrote: post #18

dullgiulio wrote: post #8

Earlier quoted context omitted.

If they steal your unencrypted laptop and you are logged in to your GMail in the browser, they can even access that and reset your password on any account you have. Rightly, this is not part of the threat model for Trello.

It looks like Trello supports Yubikeys? What's the threat model there?

Support != require

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#25

Post by msbarnett » Wed, Jul 03, 2019, 7:49 PM UTC

jbverschoor wrote: post #10

baronswindle wrote: post #7

I might be an idiot to ask this, but how is this different from the AWS CLI storing IAM keys in ~/.aws/credentials ?

Or the private keys in ~/.ssh?

You almost certain should be storing your keys encrypted with a decent passphrase.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#26

Post by benatkin » Wed, Jul 03, 2019, 7:59 PM UTC

dullgiulio wrote: post #8

benatkin wrote: post #6

Earlier quoted context omitted.

It is sort of an issue. If anyone has an unencrypted disk and gets their computer stolen but not their login password, they would have access to their token when it's stored unencrypted, but if it were stored encrypted, they wouldn't have access to it. Atlassian's response is basically a cop-out. I've barely used Electron but I know about node-keytar. SSH keys can be encrypted even if the disk isn't encrypted, and th…

If they steal your unencrypted laptop and you are logged in to your GMail in the browser, they can even access that and reset your password on any account you have. Rightly, this is not part of the threat model for Trello.

I believe you're mistaken. They would need your password to boot up the computer or unlock your screen. I think the cookies on Chrome are encrypted using the same mechanism as node-keytar. I didn't say anything about stealing a laptop while it's logged in. I just mean physically stealing the laptop.

You could argue that the number of people who protect their computer by password but don't encrypt their disks is too small or isn't worth worrying about. But I know that there is a significant portion of users that has it set up this way.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#27

Post by benatkin » Wed, Jul 03, 2019, 8:01 PM UTC

floatingatoll wrote: post #19

benatkin wrote: post #6

Earlier quoted context omitted.

It is sort of an issue. If anyone has an unencrypted disk and gets their computer stolen but not their login password, they would have access to their token when it's stored unencrypted, but if it were stored encrypted, they wouldn't have access to it. Atlassian's response is basically a cop-out. I've barely used Electron but I know about node-keytar. SSH keys can be encrypted even if the disk isn't encrypted, and th…

iOS stores app tokens in plaintext, on an encrypted disk. If your disk is unencrypted, every session token in your browser can be stolen and used to impersonate you, on services such as GitHub, Google, and others. There are no excuses for using an unencrypted disk for session token storage, whether in-browser or in-application or other.

The key part is on an encrypted disk. That makes a big difference.

node-keytar has support for encryption on an unencrypted disk. Lose the password and you're locked out.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#28

Post by nemothekid » Wed, Jul 03, 2019, 8:03 PM UTC

benatkin wrote: post #26

dullgiulio wrote: post #8

Earlier quoted context omitted.

If they steal your unencrypted laptop and you are logged in to your GMail in the browser, they can even access that and reset your password on any account you have. Rightly, this is not part of the threat model for Trello.

I believe you're mistaken. They would need your password to boot up the computer or unlock your screen. I think the cookies on Chrome are encrypted using the same mechanism as node-keytar. I didn't say anything about stealing a laptop while it's logged in. I just mean physically stealing the laptop. You could argue that the number of people who protect their computer by password but don't encrypt their disks is too s…

If your disk is unencrypted, all I need to do is mount your disk on my computer and point my Chrome user disk to /mnt/stolen_drive/home/users/James/chrome_data and I have all your cookies.

I'm not sure about Linux, but on Windows this is trivial. If you are concerned about this attack vector, then encrypt this drive. If you are hit by an RCE, then your Trello keys are the least of your problems.

Physical access is game over.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#29

Post by macspoofing » Wed, Jul 03, 2019, 8:06 PM UTC

msbarnett wrote: post #25

jbverschoor wrote: post #10

Earlier quoted context omitted.

Or the private keys in ~/.ssh?

You almost certain should be storing your keys encrypted with a decent passphrase.

And if you want headless access this passphrase will be stored unencrypted. This is nothing more than security Kabuki theater.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#30

Post by benatkin » Wed, Jul 03, 2019, 8:06 PM UTC

nemothekid wrote: post #28

benatkin wrote: post #26

Earlier quoted context omitted.

I believe you're mistaken. They would need your password to boot up the computer or unlock your screen. I think the cookies on Chrome are encrypted using the same mechanism as node-keytar. I didn't say anything about stealing a laptop while it's logged in. I just mean physically stealing the laptop. You could argue that the number of people who protect their computer by password but don't encrypt their disks is too s…

If your disk is unencrypted, all I need to do is mount your disk on my computer and point my Chrome user disk to /mnt/stolen_drive/home/users/James/chrome_data and I have all your cookies. I'm not sure about Linux, but on Windows this is trivial. If you are concerned about this attack vector, then encrypt this drive. If you are hit by an RCE, then your Trello keys are the least of your problems. Physical access is ga…

You have the encrypted cookies. You can't use the encrypted cookie to login with gmail.

It might only encrypt some of the cookies, but encrypting cookies in such a way that you need to be able to log in or unlock the screen with your password is a thing. https://stackoverflow.com/questions/22532870/encrypted-cooki...

Otherwise there would be no point in such projects as node-keytar.