Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trello Desktop Application Stores Authentication Token in Plain Text

medium.com

Post reply on HN
Print view View original

41–45 of 45 posts

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#41

Post by imtringued »

simlevesque wrote: post #37
poyu wrote: post #35

Earlier quoted context omitted.

Can you share how to achieve this?

On linux, I use ssh-agent. My key at ~/.ssh/id_rsa is encrypted. When my shell starts, it boots ssh-agent (add "eval `ssh-agent`" to your ~/.bashrc) Still in the shell boot, it tries to add the ssh key to the keychain (add "ssh-add" to your ~/.bashrc), and it asks for my private key password. Once I enter the password, my key is unlocked for as long at ssh-agent is running (usually until I shut down my computer). My…

I can already see the headline "ssh-agent desktop application stores private keys in plain text".

There is no solution to the problem of the author beyond demanding a password on every single interaction.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#42

Post by javagram »

poyu wrote: post #35
javagram wrote: post #11

Earlier quoted context omitted.

The private keys in .ssh can be stored encrypted. I do that, and store the decryption key in macOS keychain.

Can you share how to achieve this?

https://apple.stackexchange.com/a/250572

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#43

Post by simlevesque »

asadlionpk wrote: post #40
simlevesque wrote: post #38

Earlier quoted context omitted.

Well, yeah, some keys must be unencrypted to be useful. But in a lot of cases you can and should encrypt your keys used to do manual stuff.

In this scenario, wouldn't that mean the user will have to enter a passphrase on each Trello boot to be able to use it? (ask for passphrase -> decrypt auth token -> Access API)

No, you use ssh-agent.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#44

Post by macspoofing »

simlevesque wrote: post #43
asadlionpk wrote: post #40

Earlier quoted context omitted.

In this scenario, wouldn't that mean the user will have to enter a passphrase on each Trello boot to be able to use it? (ask for passphrase -> decrypt auth token -> Access API)

No, you use ssh-agent.

Or you can restrict the file with the key to a specific user and only run the process as that user.

The point is, you haven't actually solved the problem. It's not magic. In a 2-system authentication scheme, where headless access is necessary, a key needs to be somewhere in plaintext accessible to the process. You can obfuscate this, or add OS controls, or hardware chips, or ssh-agent, or keystores, or web-services for keys, but it doesn't change this reality.

Re: Trello Desktop Application Stores Authentication Token in Plain Text

#45

Post by msbarnett »

macspoofing wrote: post #29
msbarnett wrote: post #25

Earlier quoted context omitted.

You almost certain should be storing your keys encrypted with a decent passphrase.

And if you want headless access this passphrase will be stored unencrypted. This is nothing more than security Kabuki theater.

Indeed if you want to do something stupid, something stupid will be the result
Post reply on HN