floccusaddon / floccusaddon/floccus

do not store profile passwords in clear text

Open
#1,905 5 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
JavaScript
Stars
8.5k
Forks
327
Avg merge
3d 14h
Merged PRs (30d)
2

Description

### Describe the feature you'd like to request

Today I noticed that the chrome (and chromium) extensions (on linux) are storing the (webdav) passwords in clear text in both the *.log and *.ldb files, i.e.

```
/home/jtingiris/.config/google-chrome/Floccus Profile/Local Extension Settings/fnaicdffflnofjppbagibeoednhnbjhg/000144.log
/home/jtingiris/.config/google-chrome/Floccus Profile/Local Extension Settings/fnaicdffflnofjppbagibeoednhnbjhg/000146.ldb
/home/jtingiris/.config/chromium/Default/Local Extension Settings/fnaicdffflnofjppbagibeoednhnbjhg/000302.log
/home/jtingiris/.config/chromium/Default/Local Extension Settings/fnaicdffflnofjppbagibeoednhnbjhg/000304.ldb
```

stores its json ..

```
{
"17438009688830.4750445422309294": {
"type": "webdav",
"url": "https://my.dav.server/blah",
"username": "jtingiris",
"password": "THIS_PASSWORD_IS_TOO_EASY_TO_READ",
"bookmark_file": "bookmarks.xbel",
"bookmark_file_type": "xbel",
"includeCredentials": false,
"allowRedirects": false,
"passphrase": "",
"allowNetwork": false,
"enabled": true,
"label": "bookmarks",
"localRoot": "0",
"syncInterval": 15,
"strategy": "default",
"nestedSync": true,
"syncing": false,
"scheduled": false,
"error": null,
"errorCount": 0,
"lastSync": 1743942607529,
"failsafe": true,
"clickCountEnabled": false
}
}
```

and those files can be easily read by anyone with access to that home directory.

My main concern is on multi-user systems, particularly those in which more than one person has admin/root access.

### Describe the solution you'd like

Chrome, Firefox, and Safari all offer built-in password storage features, e.g. the Chrome Credential Management API. Or, prompt for the password every time the browser is started. At the very least, come up with your own reversible hash or something. Don't put the full json in the logs. I realize this can be a difficult feature to implement properly but it doesn't have to be SO easy.

example:

```
// Request credentials from the user
chrome.identity.get(function(credential) {
if (credential) {
// Credentials retrieved successfully
var username = credential.username;
var password = credential.password;
// Use the credentials
} else {
// Handle the case where credentials are not available
}
});
```

### Describe alternatives you've considered

Go back to the default edge, chrome, or firefox sync methods which do not store clear text credentials on the filesystem.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.