geldata / geldata/gel-cli

Consider not to store password in plain text

Open
#1,108 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Rust
Stars
175
Forks
32
PR merge metrics
No merged PRs in 30d

Description

```
foxpro:~$ edgedb instance credentials -I dev
┌──────────────┬───────────┐
│ Host │ localhost │
│ Port │ 10703 │
│ User │ edgedb │
│ Password │ │
│ Database │ edgedb │
│ TLS Security │ Default │
└──────────────┴───────────┘
```
it's `hidden`, but actually stored in plain text.
`foxpro:~$ cat /home/foxpro/.config/edgedb/credentials/dev.json`
```json
{
"port": 10703,
"user": "edgedb",
"password": "Iszh3PvXuq5h8S3eyBgaqoDS", <- wtf?
"database": "edgedb",
"tls_cert_data": "...",
"tls_ca": "...",
"tls_security": "default"
}
```

I'm not security expert, but seems like it's bad idea.
I can suggest to show prompt for password and let user store it as they wants. For example, it can be done with `PGP` or `age` encryption.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.