starred/floccus

Fork 0

mirror of https://github.com/floccusaddon/floccus.git synced 2026-04-26 14:45:59 +03:00

[GH-ISSUE #159] Need to protect the server password #149

New issue

Closed

opened 2026-02-25 22:36:17 +03:00 by kerem · 14 comments

kerem commented

2026-02-25 22:36:17 +03:00

Owner

Originally created by @nachoparker on GitHub (Aug 30, 2018).
Original GitHub issue: https://github.com/floccusaddon/floccus/issues/159

Hello,

First, thank you for your hard work in this addon. I have been using it for a few days and it is really nice!!

The only bad thing I see about it is sadly a serious one. I downloaded the debug log and to my surprise there it was, my server's password.

A simple grep -r mypass in the ~/.mozilla folder showed me that any agent that manages read access to this folder will immediately gain access to my private cloud where I store all my sensitive private information.

What would be the best way to grant access without storing the password in plain text? Maybe the user could be required to generate a random tokens to decrypt the password that then would only be unencrypted in memory before being sent through HTTPS.

Thoughts?

Originally created by @nachoparker on GitHub (Aug 30, 2018). Original GitHub issue: https://github.com/floccusaddon/floccus/issues/159 Hello, First, thank you for your hard work in this addon. I have been using it for a few days and it is really nice!! The only bad thing I see about it is sadly a serious one. I downloaded the debug log and to my surprise there it was, my server's password. A simple `grep -r mypass` in the `~/.mozilla` folder showed me that any agent that manages read access to this folder will immediately gain access to my private cloud where I store all my sensitive private information. What would be the best way to grant access without storing the password in plain text? Maybe the user could be required to generate a random tokens to decrypt the password that then would only be unencrypted in memory before being sent through HTTPS. Thoughts?

kerem

2026-02-25 22:36:17 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@marcelklehr commented on GitHub (Aug 30, 2018):

Hey nacho! Thanks for your kind words :)
The password leakage you mention is actually a regression, as the passwords are persisted in an encrypted fashion if you set a n extension passphrase, but the logging mechanism doesn't care about that, yet. I'll get on it :)

@marcelklehr commented on GitHub (Aug 30, 2018): Hey nacho! Thanks for your kind words :) The password leakage you mention is actually a regression, as the passwords are persisted in an encrypted fashion if you set a n extension passphrase, but the logging mechanism doesn't care about that, yet. I'll get on it :)

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@nachoparker commented on GitHub (Aug 31, 2018):

Thank you! that was fast!

my password is still in cleartext in firefox/w24O4c.default/browser-extension-data/floccus@handmadeideas.org/storage.js, I think it should be somehow encrypted. Agree?

@nachoparker commented on GitHub (Aug 31, 2018): Thank you! that was fast! my password is still in cleartext in `firefox/w24O4c.default/browser-extension-data/floccus@handmadeideas.org/storage.js`, I think it should be somehow encrypted. Agree?

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@marcelklehr commented on GitHub (Aug 31, 2018):

Have you set a passphrase (Tick "secure your credentials") and restarted your browser? I think, that file is only written when you close the browser.

@marcelklehr commented on GitHub (Aug 31, 2018): Have you set a passphrase (Tick "secure your credentials") and restarted your browser? I think, that file is only written when you close the browser.

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@nachoparker commented on GitHub (Aug 31, 2018):

I have, but the password is still there

@nachoparker commented on GitHub (Aug 31, 2018): I have, but the password is still there

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@marcelklehr commented on GitHub (Aug 31, 2018):

Fooo. That's tough. Which adapter? Which firefox version?

@marcelklehr commented on GitHub (Aug 31, 2018): Fooo. That's tough. Which adapter? Which firefox version?

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@nachoparker commented on GitHub (Sep 1, 2018):

firefox 61.0.2

adapter? what is an adapter?

@nachoparker commented on GitHub (Sep 1, 2018): firefox 61.0.2 adapter? what is an adapter?

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@marcelklehr commented on GitHub (Sep 1, 2018):

Sorry. Which backend are you using? XBEL/WebDAV or Nextcloud Bookmarks? :)

@marcelklehr commented on GitHub (Sep 1, 2018): Sorry. Which backend are you using? XBEL/WebDAV or Nextcloud Bookmarks? :)

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@nachoparker commented on GitHub (Sep 1, 2018):

aah :D

NC bookmarks

@nachoparker commented on GitHub (Sep 1, 2018): aah :D NC bookmarks

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@marcelklehr commented on GitHub (Sep 1, 2018):

Which floccus version?

@marcelklehr commented on GitHub (Sep 1, 2018): Which floccus version?

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@nachoparker commented on GitHub (Sep 1, 2018):

floccus 3.0.6

@nachoparker commented on GitHub (Sep 1, 2018): floccus 3.0.6

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@marcelklehr commented on GitHub (Sep 2, 2018):

Aah, now I get it. The logs are not cleared, of course, so the existing log data that still contain the password are of course still there. You can uninstall and reinstall the extension to fix that. (You really had my questioning myself there :D)

EDIT: By deafult, the log rotates with a cycle of 2500 entries, so after a while your password will rotate out of the file ;)

@marcelklehr commented on GitHub (Sep 2, 2018): Aah, now I get it. The logs are not cleared, of course, so the existing log data that still contain the password are of course still there. You can uninstall and reinstall the extension to fix that. (You really had my questioning myself there :D) EDIT: By deafult, the log rotates with a cycle of 2500 entries, so after a while your password will rotate out of the file ;)

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@nachoparker commented on GitHub (Sep 2, 2018):

I don't know when it happened, but the password is now encrypted in storage.js. This file doesn't seem to be logs (which I deleted), but the user configuration. In any case seems to be solved.

I suggest you make password protection mandatory, non optional in order to protect your users. We all know that most people will not protect their passwords otherwise.

Many thanks for the help!

@nachoparker commented on GitHub (Sep 2, 2018): I don't know when it happened, but the password is now encrypted in `storage.js`. This file doesn't seem to be logs (which I deleted), but the user configuration. In any case seems to be solved. I suggest you make password protection mandatory, non optional in order to protect your users. We all know that most people will not protect their passwords otherwise. Many thanks for the help!

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@marcelklehr commented on GitHub (Sep 2, 2018):

I suggest you make password protection mandatory, non optional in order to protect your users. We all know that most people will not protect their passwords otherwise.

Good idea! :)

@marcelklehr commented on GitHub (Sep 2, 2018): > I suggest you make password protection mandatory, non optional in order to protect your users. We all know that most people will not protect their passwords otherwise. Good idea! :)

kerem commented

2026-02-25 22:36:18 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 21, 2023):

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@github-actions[bot] commented on GitHub (Mar 21, 2023): This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/floccus#149

No description provided.

Rows
Columns