News for hackers. Stuff that matters.

A comment on Trello Desktop Application Stores Authentication Token in Plain Text. Parent comment

Re:Trello Desktop Application Stores Authentication Token in... by asadlionpk on Wednesday July 03, 2019 @06:31PM (#20349582)
In this scenario, wouldn't that mean the user will have to enter a passphrase on each Trello boot to be able to use it?

(ask for passphrase -> decrypt auth token -> Access API)

[ Parent | on HN ]
Re:Trello Desktop Application Stores Authentication Token in... by simlevesque on Thursday July 04, 2019 @11:23AM (#20355341)
No, you use ssh-agent.
[ Parent | on HN ]
Re:Trello Desktop Application Stores Authentication Token in... by macspoofing on Thursday July 04, 2019 @01:26PM (#20356252)
Or you can restrict the file with the key to a specific user and only run the process as that user.

The point is, you haven't actually solved the problem. It's not magic. In a 2-system authentication scheme, where headless access is necessary, a key needs to be somewhere in plaintext accessible to the process. You can obfuscate this, or add OS controls, or hardware chips, or ssh-agent, or keystores, or web-services for keys, but it doesn't change this reality.

[ Parent | on HN ]