security issue on remote storage credentials

  • Resolved Tanvir Roky

    (@tanvirroky)


    3 years ago

    If I configure and save an FTP/SFTP account, the credentials can be seen easily from the storage provider setting. If I give someone admin access for any development purpose they can see those data easily. If I use the same server on multiple websites for backup, someone with access to one site can get the credentials and access to another website’s backup files. This might be the same on Amazon and DigitalOcean accounts. I haven’t tried.
    So my suggestion is, do not show the FTP server username and password in the setting. Instead, add a button to edit the information (with empty input fields) if someone wants to reconfigure. Even previous username and password should not display when editing.

Viewing 11 replies - 1 through 11 (of 11 total)
  • Plugin Support tonyrobins

    (@tonyrobins)

    3 years ago

    Hello @tanvirroky

    Thanks for your feedback.

    The passwords for all the cloud storage are already encrypted(not in plain text) on the storage adding and editing page, please see the screenshot. And they are also encrypted in the website databases where they are stored.

    All the best,

    Thread Starter Tanvir Roky

    (@tanvirroky)

    3 years ago

    😲 you call this encrypted? It can be shown as plain text just by changing the type to text from inspect element option of any browser. It’s just hidden by CSS. https://snipboard.io/jDefmY.jpg
    Also not encrypted in the database. https://snipboard.io/1SBWKc.jpg

    Plugin Support tonyrobins

    (@tonyrobins)

    3 years ago

    Hi @tanvirroky

    Thanks for your update.

    In that case, your suggestion would be a nice solution. Let us discuss and implement it.

    The password is encrypted in the database, as you can see in this screenshot, the password in the screenshot is not the real password, it has been encoded. Is the one in your screenshot the real password?

    All the best,

    Thread Starter Tanvir Roky

    (@tanvirroky)

    3 years ago

    Thanks for your concern.
    Yes, the password is in plain text in the database in both of my screenshots (?%_______%%). The screenshot you shared is also showing in plain text i guess. One more thing, If the password is encrypted oneway in the database how could it be used next time when need to connect. Encryption on database is not nessacery i thing. You can add a function to ask FTP password/access key when retrieving a backup file from the remote server or trying to download it. Because if password is not encrypted and someone downloads the backup file and restores it on another host, they can get the FTP information there. Asking FTP password to retrieve or download backup file will be another level of security.

    Plugin Support tonyrobins

    (@tonyrobins)

    3 years ago

    Hi @tanvirroky

    Sorry that after checking it with our developers, I realized that it has not implemented in the free version yet(the screenshot I sent you was from the pro version). So, let us discuss and implement it as well.

    The password in my screenshot is in plain text but has been encoded, therefore is not the real password, for example, the real password is 123 while in the database it has been encoded to 6789. It does not affect next connection.

    All the best,

    Plugin Support tonyrobins

    (@tonyrobins)

    3 years ago

    Hi @tanvirroky

    After discussing it, we have decided to implement your suggestion of ‘do not show the FTP server username and password in the setting’. Also we have decided to implement encryption of the storage password in database in the next few versions.

    Thanks again for your suggestions to help improve the plugin.

    All the best,

    Thread Starter Tanvir Roky

    (@tanvirroky)

    3 years ago

    Thanks a lot.

    Plugin Support tonyrobins

    (@tonyrobins)

    3 years ago

    No problem and thanks again!

    Plugin Support tonyrobins

    (@tonyrobins)

    2 years, 11 months ago

    Hi @tanvirroky

    The new version 0.9.72 is ready. In the new version, we have implemented the features you suggested, you can update the plugin and check it out.

    All the best,

    Thread Starter Tanvir Roky

    (@tanvirroky)

    2 years, 11 months ago

    Thank you so much

    Plugin Support tonyrobins

    (@tonyrobins)

    2 years, 11 months ago

    No problem.

    All the best

Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘security issue on remote storage credentials’ is closed to new replies.