Sqlite database contains plaintext account passwords (again?)

asked 2016-03-12 13:11:55 +0200

GvH gravatar image

In the answer to https://together.jolla.com/question/39495/security-risk-with-sqlite-db-in-jolla-passwords-in-plain-text-in-user-space/ , it is stated that as of Sailfish 1.0.7, the passwords are no longer saved in plaintext in /home/nemo/.config/signond/*.db -- however, in SailfishOS 2.0.0.10 (Saimaa), IMAP passwords seem to be stored in plaintext again, Moreover, ownership of the files apparently has reverted to nemo:nemo.

edit retag flag offensive close delete

Comments

Hi. I see the passwords are stored in plaintext and can be accessed by root, but the folder /home/nemo/.config/signon is not accesible for user nemo.... Regards.

Pasko ( 2016-03-12 14:58:11 +0200 )edit
6

OK but what about /home/nemo/.vault/Accounts/blobs/accounts.dump?

Any password should definitely be encrypted, fullstop.

objectifnul ( 2016-03-12 15:18:58 +0200 )edit
5

nemo can access the file using the web browser. That's a problem because a malicious web site could contain a hidden form with a file upload getting those files.

GvH ( 2016-03-12 15:35:06 +0200 )edit
4

So until further notice, if you are a privacy paranoid you should move your vault to the SDcard (with ad hoc settings utility) then move backup.tar to an encrypted container (GnuPG, Truecrypt). Even those paranoid moves aren't enough: /nemo/.config/signond/*.db contents still are at risk...

This bug is definitely very disappointing. Kind of amateur work, specially after it was identified, then fixed, then re-introduced. A quick response is absolutely essential, beyond the specific issue. It's a matter of credibiliy.

objectifnul ( 2016-03-12 22:47:52 +0200 )edit
1

specially after it was identified, then fixed, then re-introduced

Sadly it would appear that there are a number of surprising regressions in 2.0.0.10, and I'm beginning to suspect they'll not be fixed. At least, not in any reasonable timeframe.

strongm ( 2016-03-13 16:49:09 +0200 )edit