Bugzilla – Bug 516
Password visible in Properties view
Last modified: 2011-06-03 14:51:45 UTC
DETAILED DESCRIPTION: In the modeler, add an identity vault and edit the properties. Add a host name, username, and password and click OK to save the values. Select the Identity Vault in the modeler and look in the Properties View and you can see the password value in clear text! This brings up the question of how that password is stored in Designer. It might be better to simply prompt for the password whenever it is needed rather than store the password in Designer. BUILD NUMBER: 0909 integration build 8 Oses/CONFIG: Win2KPro STEPS TO REPRO: RESULTS: EXPECTED: WORKAROUNDS: CUSTOMER IMPACT:
wpeterson ( 12/8/2004 3:17:17 PM Fixing - Fix Is Checked-In ) I added encode / decode functionality to the identity vault password bstreet ( 12/3/2004 9:48:14 AM Fixing - Approved for Investigation ) Will- The storage of a password obfuscated is yours to handle in the model right. tpew ( 11/30/2004 2:03:17 PM Fixing - Failed ) The password is hidden now, but there's still the other part of the issue around storing an eDir password in a project. bstreet ( 9/13/2004 5:42:06 PM Fixing - Approved for Investigation ) We need to always prompt for passwords when accessing a directory or prompt for a password when you login to designer. We need to store the passwords encrypted as well tpew ( 9/13/2004 11:08:47 AM Fixing - Failed ) Nothing has changed in the M1 build. Why was this assigned back to me? tpew ( 9/10/2004 10:46:04 AM Fixing - Info/Resources Required ) Here's my concern: If we store the username AND password in Designer, then anyone who gets on the machine has access to the directory. It's very shaky security if the user can automatically login without proving who they are. I'm not suggesting that we force a re-enter of passwords everywhere, but they should have to enter it once and then we can use that authenticated session until Designer is closed or the session times out. llowry ( 9/8/2004 3:15:35 PM Fixing - Approved for Investigation ) In the future, the password will be encypted in the Project View. It's too much burden to force a re-entering of passwords everywhere. bstreet ( 9/8/2004 12:18:38 PM Fixing - New ) We applied for an ECR for M1 and told the export people that post-m1 we would be determining a way to encrypt passwords. This is post M1.
Transferred from Remedy DEFECT000382748. Status when transferred: Fixing/Fix Is Checked-In
This defect has been checked in.
Included in Designer build 20050103
Included in Designer build 20050104
Included in Designer build 20050107
Included in Designer build 20050111
Included in build 20050112
Included in build 20050113
Included in Designer build 20050114
Included in Designer build 20050119
Included in designer build 20050121
Included in Designer build 20050124
Included in Designer build 20050125
Included in the Designer build 20050201
Included in Designer build 20050207
Adding built keyword.
Marking closed/resolved fixed bugs public view.