Consider not to store password in plain text
- Dominant language
- Rust
- Stars
- 175
- Forks
- 32
- PR merge metrics
- No merged PRs in 30d
Description
```
foxpro:~$ edgedb instance credentials -I dev
┌──────────────┬───────────┐
│ Host │ localhost │
│ Port │ 10703 │
│ User │ edgedb │
│ Password │ │
│ Database │ edgedb │
│ TLS Security │ Default │
└──────────────┴───────────┘
```
it's `hidden`, but actually stored in plain text.
`foxpro:~$ cat /home/foxpro/.config/edgedb/credentials/dev.json`
```json
{
"port": 10703,
"user": "edgedb",
"password": "Iszh3PvXuq5h8S3eyBgaqoDS", <- wtf?
"database": "edgedb",
"tls_cert_data": "...",
"tls_ca": "...",
"tls_security": "default"
}
```
I'm not security expert, but seems like it's bad idea.
I can suggest to show prompt for password and let user store it as they wants. For example, it can be done with `PGP` or `age` encryption.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.