Trello Desktop Application Stores Authentication Token in Plain Text

Re:Trello Desktop Application Stores Authentication Token in... by javagram on Wednesday July 03, 2019 @03:17PM (#20347669)

The private keys in .ssh can be stored encrypted. I do that, and store the decryption key in macOS keychain.

[ Parent | on HN ]

Re:Trello Desktop Application Stores Authentication Token in... by poyu on Wednesday July 03, 2019 @05:09PM (#20348806)

Can you share how to achieve this?

[ Parent | on HN ]

Re:Trello Desktop Application Stores Authentication Token in... by simlevesque on Wednesday July 03, 2019 @05:27PM (#20348998)

On linux, I use ssh-agent. My key at ~/.ssh/id_rsa is encrypted.

When my shell starts, it boots ssh-agent (add "eval `ssh-agent`" to your ~/.bashrc)

Still in the shell boot, it tries to add the ssh key to the keychain (add "ssh-add" to your ~/.bashrc), and it asks for my private key password. Once I enter the password, my key is unlocked for as long at ssh-agent is running (usually until I shut down my computer).

My password is a long, I only need to enter it once a day so it's not really a problem. You can add multiple keys to the ssh-agent (ssh-add mykey.pem). The private key must have these permissions: 0400 (chmod 0400 mykey.pem).

[ Parent | on HN ]

Re:Trello Desktop Application Stores Authentication Token in... by imtringued on Wednesday July 03, 2019 @07:55PM (#20350222)

I can already see the headline "ssh-agent desktop application stores private keys in plain text".

There is no solution to the problem of the author beyond demanding a password on every single interaction.

[ Parent | on HN ]

Re:Trello Desktop Application Stores Authentication Token in... by javagram on Thursday July 04, 2019 @09:56AM (#20354663)

https://apple.stackexchange.com/a/250572

[ Parent | on HN ]