GNOME Bugzilla – Bug 568135
unproper handling of passwords on ekiga.net web site
Last modified: 2015-02-26 19:44:15 UTC
* when a new user is registered the password is sent in email. this should never occur. * further, registration page does not use SSL. both of these put users passwords in jeopardy and might affect users trust in open source security. additional check: * make sure only hashes of passwords are stored centrally, not the passwords themselves
(In reply to comment #0) > * when a new user is registered the password is sent in email. this should > never occur. Which is also a philosophic question. Mailinglist engines do that, for example. But I agree with you (but: You would be surprised how many subscribers forget their password immediately after leaving the reg page...). > * further, registration page does not use SSL. Can you provide the URL? I can't imagine.
(In reply to comment #0) > additional check: > * make sure only hashes of passwords are stored centrally, not the passwords > themselves This is really important. Passwords should never ever be stored in clear text. If you, for example, collect a GDB backtrace after a segfault of Ekiga, the password will be clearly written in there. If you don’t notice this, everyone will know your password soon. This is a huge security issue.
This could be done with gnome-keyring, see http://bugzilla.gnome.org/show_bug.cgi?id=555394
Yes in gnome -- but what on win32/MOSX/KDE/XFCE/Enlightenment ?
http://www.gnu.org/software/gnu-crypto/manual/api/gnu/crypto/keyring/package-summary.html
Passwords are stored in ekiga.net, I do not know if they are encrypted or not. Passwords are also stored on user's computer, and they are unencrypted. Here it could be useful to encrypt them. Joel, does your proposal work on windows too?
Scroll down below and u'll find this there as one of the project goal.. "Compatibility with the JDK. This means that it should be possible to use this format as a keystore, so GNU implementations of the Java platform can provide the same functionality as the JDK" i haven tried it yet..but yes..if u want i'll get a hello world up in this library and tell you more ;) what specifically do u want me to test for?
*** Bug 555394 has been marked as a duplicate of this bug. ***
We're not the only ones : http://developer.pidgin.im/ticket/673 and the last link may be pretty interesting : http://ppasskeeper.mupuf.org/
This bug is for ekiga.net, the other (bug #555394) is for ekiga client.
The password is not sent anymore, it is just reminded in the registration web page, which is using https. We need to improve the password reminder thingy... But that's another problem and should probably be described in another bug report.
As of 2015-02-26 the passwords are still decrypt-able (not one way hashed) and are decrypted and sent over plain text email during "forgot password"