22 ms·

Looks like the Google API client ID and client secret are stored in clear text shipped with the released app: WMail.app/Contents/Resources/app/bin/shared/cre

by songgao 11y ago

Looks like the Google API client ID and client secret are stored in clear text shipped with the released app: WMail.app/Contents/Resources/app/bin/shared/credentials.js , and this seems to be used in authentication with Google: https://github.com/Thomas101/wmail/blob/master/src/main/AuthGoogle.js#L61 https://github.com/Thomas101/wmail/blob/master/src/main/Auth...

AntiRush 11y ago
I think "secret" is a misnomer here. The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.) https://developers.google.com/identity/protocols/OAuth2 https://developers.google.com/identity/protocols/OAuth2 (under "Installed Applications")
- songgao 11y ago
  Interesting. Thanks for the link! I wonder why they still require a client_secret in installed application?
AndrewGaspar 11y ago
There's not really anything you can do about this unless you want Wmail to have to stand up a server to authenticate with, at which point you're no really getting any additional security because Wmail still needs to store some sort of credential on your machine for persistent login that an attacker could steal to authenticate with Wmail on their own machine. An attacker would have to steal your access token stored locally on your machine to use with this public client id and client secret, and if you have software that's maliciously scraping credentials from your machine you already have a problem.
- derefr 11y ago
  There's still a reason why e.g. the OSX Keychain, SSH private keys, etc. are stored encrypted-at-rest. I like the fact that I can create a cleartext backup of my hard disk and throw it in the trash, and the person who finds it won't be able to get my passwords off of it.

22 ms·

Looks like the Google API client ID and client secret are stored in clear text shipped with the released app: WMail.app/Contents/Resources/app/bin/shared/cre

by songgao 11y ago

AntiRush 11y ago
I think "secret" is a misnomer here. The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.) https://developers.google.com/identity/protocols/OAuth2 https://developers.google.com/identity/protocols/OAuth2 (under "Installed Applications")
- songgao 11y ago
  Interesting. Thanks for the link! I wonder why they still require a client_secret in installed application?
AndrewGaspar 11y ago
There's not really anything you can do about this unless you want Wmail to have to stand up a server to authenticate with, at which point you're no really getting any additional security because Wmail still needs to store some sort of credential on your machine for persistent login that an attacker could steal to authenticate with Wmail on their own machine. An attacker would have to steal your access token stored locally on your machine to use with this public client id and client secret, and if you have software that's maliciously scraping credentials from your machine you already have a problem.
- derefr 11y ago
  There's still a reason why e.g. the OSX Keychain, SSH private keys, etc. are stored encrypted-at-rest. I like the fact that I can create a cleartext backup of my hard disk and throw it in the trash, and the person who finds it won't be able to get my passwords off of it.