/data/data.db file contains plain passwords - how to secure this more about bicbucstriim HOT 7 CLOSED

maybe encrypt the passwords with md5 or sha with the combination of a salt?

from bicbucstriim.

Yes, SHA encryption or else is certainly possible. But with the current use case that seemed to be overkill. There are no users to protect from evil administrators. I guessed. if somebody has access to your sqlite db then they are already on the NAS and don't need passwords to access the books.

from bicbucstriim.

But what if the admin password is used for other things as well?

A regular user might be allowed to access the books, but not to change or modify things.

The system runs a external website aswell.

Van: Rainer Volz [mailto:[email protected]]
Verzonden: zondag 26 mei 2013 15:05
Aan: rvolz/BicBucStriim
CC: isr001
Onderwerp: Re: [BicBucStriim] /data/data.db file contains plain passwords - how to secure this more (#53)

Yes, SHA encryption or else is certainly possible. But with the current use case that seemed to be overkill. There are no users to protect from evil administrators. I guessed. if somebody has access to your sqlite db then they are already on the NAS and don't need passwords to access the books.

—
Reply to this email directly or view it on GitHub #53 (comment) . https://github.com/notifications/beacon/OCaJNf792qn9ZNLrI2TT7BaS21nS-hDY7mi_edh_HeT6J6grkZfVIcOUAu5J-nAv.gif

from bicbucstriim.

I Think maybe for someone who is using it on a server that's online and can be viewed by anyone.
Just enter after the address data/data.db and they can read the file. If the password is protected, then they can't access the admin module and also not know the password for protecting the books.

from bicbucstriim.

you can do both: encrypted password and make sure that data.db can only be accessed by the program and not by someone else (maybe this can be done in htaccess file)

from bicbucstriim.

Yes, this is already in V1.1: @janeczku added db protection a few weeks ago to .htaccess.

<FilesMatch data.db>
    Order allow,deny
    Deny from all
</FilesMatch>

So it shouldn't be possible to download the data.db. At least it isn't possible on my system. As long as nobody else has access to the filesystem your passwords are safe.

Anyway, v1.2 will change to a login-based system, and if that's important fo you, I'll add the possibility to encrypt passwords.

from bicbucstriim.

@rvolz. Sorry, I overlooked.

For me it's also not important. I use it on my NAS but this can't be accessed from outside.
I see some people on the internet are using an old version and you can just read the data.db file...
Maybe we have to look for in inline update that check if you have the latest version of BicBucStriim because it get more secure.

from bicbucstriim.