hide passwords in config

[anonymous]

Please consider to hide passwords from the config file if possible. config is 0600 so that is good, but I guess the ultimate solution would be to not write the password in plaintext nowhere. I use gajim for its good support for gpg encrypted messaging, and that's the only problem left to provide a secure client as far as I can see. thanks florian

[asterix]

we have gnome keyring for that ...

[junglecow]

Obfuscating of passwords does not improve security. Use Gnome Keyring or disable "Save Password" in the server configuration. I propose wontfix.

[anonymous]

Replying to asterix:

we have gnome keyring for that ...

There are no gnome-keyring for Windows ...

[asterix]

junglecow's comment remain ... a coded password can still be decrypted easily: just look in gajim code how to decrypt and that's it

[anonymous]

I think it should be fixed, even just for eyecandy. No matter chmods, it freaks out to read it as plain text in file that is not encrypted. No matter if someone can decrypt it, but it makes much more harm to store it plainly, offer it straightaway. It is important to consider that the config file can get (for some reason) to wrong hands, somewhere where it doesn't belong, maybe just if someone uses your computer ("oops, i opened some config and guess what..") or anything, like with any file. I am not writing this to guess all the possible reasons how someone could get their hands to that file, I just hope you could give that an another thought. So, can you please reconsider?

(And for your comments, it is not right to force people to use Gnome Keyring. I hope you didn't mean it like that.)

[misc]

I see no reason to work around windows problem ( ie lack of proper mechanism to store password ) by duplicating work in gajim. If you know a way to store password in a real secure way on windows, please provides a patch, or at least, a API tohat could be used from python.

[anonymous]

I don't know about windows, not used it. It is not just windows problem, they are stored as plain text on Linux also. There are crypt at least for UNIX and even MD5 is better than nothing. If you really don't want to work around windows problem, please even with the Linux? There it is possible in a secure way.

I am sorry that I am not skilled enough to provide patch for you. Still it shouldn't need to dublicate the work, at least I hope so. I am not a programmer, but you are and you know better than I how to do that. In my eyes it can be done simple just like with crypt function "import crypt; crypt.crypt("crypt","ed")"  http://docs.python.org/lib/module-crypt.html

If want to work with windows, There are actually "crypt for windows", the fcrypt, so windows can use fcrypt as crypt.. It's pure Python replacement library  http://home.clear.net.nz/pages/c.evans/sw/

Do what you want, but I really really hope you to consider that. I would like to use my favorite client in a secure way.

[misc]

crypt and md5 are hash function, so everything encrypted cannot be decrypted ( unless bruteforced ).

Since we need to get the password in cleartext to send it to server ( or use another type of hash ), in order to authenticate you, this is not suitable.

[steve-e]

There is no security by obscurity. We can hide the password easily but that will not fix anything.

I don't want anyone to believe this would be secure.

[asterix]

there are many other secure way to do that: encrypt your /home partition, or don't store passwords, or use gnome keyring. If you see a "encrypted" password in your config file, you can think it'ssecure to send it on the web, or anywhere, but it's not. It you see it plaintext, you won't send it, and that's better.