You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Maybe an option so the user can choose whether to save it or not
If it is saved, we should have a more secure way of doing so
Using machine keychain? Maybe encrypting it?
I tried to use a keychain. The password can be retrieved by any instance of the binary that created it. Unfortunately, in this case that binary is node, so any program running over it would be able to get the password.
Also, I don't think that encryption is practical, as you'll need a secret to encrypt (another password).
So, for now I see these options:
Just ask for the password every time
Distribute this program with its own binary, and implement the keychain thing
Implement anyway the keychain integration, even if it is not safe. At least the attacker should use node.
Currently the cli saves the password to
~/.sincding/data.json
in plain text.I would recommend to ask for it every time it is needed.
The text was updated successfully, but these errors were encountered: