Thoughts on storing password in cleartext in Roam about otter HOT 7 CLOSED

Yea I 100% agree. In fact most of the other integrations/RoamJS services have already moved to using local storage, just haven't gotten around to doing the same for otter yet, since it's a somewhat unique integration (the only one that asks for a password)

from otter.

poke on this, as I think it's a huge red flag on using this =.

also, another random thought on improving this is to store the password in an encrypted fashion (and retrieve decryption key from calling roamjs api, as we must call it anyway). variations possible on:

• having one rotating key for everything (only somewhat helpful, but adds a layer of protection from casual read & dump of localstorage. does not protect from a targeted attack)
• having user specific keys (better, but requires more infrastructure work on your side, and maybe at that point you might as-well store password on the server side)

from otter.

Not sure storing a decryption key with RoamJS necessarily increases security.

With the password in local storage, only one actor has access:

• those with access to the user's browser

With a decryption key stored in RoamJS, now there are two:

• those with access to the user's browser
• those with access to RoamJS

from otter.

The scheme I was proposing is: password stored in encrypted form in local storage, and decrypted on-demand by the backend when it's used (and the encryption key is stored on the backend).

In which case ideally the only time password exists in cleartext is on backend at execution time (which is the case right now as-well).

from otter.

Actually on reflection I think this provides a better security then I thought, as you don't actually need to store/or retrieve password in cleartext locally at all. So after set up you can't get back the password out of the browser (though you'd still be able to use the encrypted version of it with roamjs if the decryption key is not personalized)

from otter.

Ok yea I see how we could do this. Every RoamJS user has a personal API token that we may be able to use as the decryption key

from otter.

Thanks! will look over implementation in a bit 🙂

from otter.