4 ms·

Does pidgin still save your password in plain text (or base64-ized) in a configuration file in your home? I haven't used them in years because of this, and we a

Does pidgin still save your password in plain text (or base64-ized) in a configuration file in your home? I haven't used them in years because of this, and we also banned it in our company to avoid mistakes.

vikas0380 13y ago
yes, they are still using the plain text passwords "Purple does not now and is not likely to encrypt the passwords in the accounts.xml file, nor is it likely to be encrypted in a future release. "
Vilkku 13y ago
There is a plugin called "Windows Credentials", which according to the description uses Windows credentials instead of saving the passwords as plaintext. I am unfortunately not exactly aware of what this means in practice, but I doubt it is worse than the default behaviour. But for Windows only, one could assume.
nodata 13y ago
The file it saves your password in is only readable by you. Pidgin needs to supply the plaintext password to the server to authenticate.
lucian1900 13y ago
libpurple saving passwords in plain text is the correct decision. If it did encrypt them, it would also have to hold the key, so it would only add a false sense of security. The only improvement would be a hardware-backed secret storage mechanism, but those aren't exactly ubiquitous.
- giovannibajo1 13y ago
  It isn't. The correct decision would be to save the password in the operating system keychain, like Empathy does (or Messages on Mac, or name any others). Browsers also use keychains. On Windows, you can use the Crypto API to obtain an intermediate level of security.
  - tszming 13y ago
    >> Browsers also use keychains Google will disagree with you: chrome://settings/passwords
    - Bakkot 13y ago
      I'm still required to unlock my keychain to view the passwords (on OS X).
    - giovannibajo1 13y ago
      That's not disagreement. Those passwords are stored in the keychain.
- cradle 13y ago
  They're not the only options, passphrase encrypted local password storage is an option. That's no false sense of security.
- meowface 13y ago
  Firefox can store passwords using a master key to unlock it, yet that master key is stored securely (via hashing). libpurple/Pidgin could absolutely provide a more secure alternative by either using an OS keyring, or following Firefox's approach and requiring the user to type in a master password every time they start the client.
  - reubenmorais 13y ago
    FWIW, Firefox doesn't do it by default, the option to enable it is not prominent, and when you do enable it the UX is pretty bad. IIRC usage stats is way below 1% of users.
- smtddr 13y ago
  >>$SOFTWARE_NAME saving passwords in plain text is the correct decision. Is there any situation where this sentence would be true?
  - giovannibajo1 13y ago
    No, it isn't. It's a very very bad security mistake, and I honestly thought it was obvious to most people by now (it used to be "debatable" 6-10 years ago). People disagreeing tend to reply with blanket sentences like "if there is a process reading the files owned by you on your computer, you're already doomed", ignoring that security is made always made by layered levels, it's not an black/white issue. A file on disk could for instance end up in an unencrypted backup that goes into a server which is then exploited; it could be in a VM where you cannot control the supervisors. It might be end up being mailed to yourself for mistake while migrating computers (I know many people who do it), and thus being stored on remote servers; you might be running on a NFS-based deployment where you don't want to necessarily trust all present and future sysadmins with your personal passwords. What's worse is that there is an alternative, safe solution to this which is using the operating system keyring, which stores passwords fully encrypted, and also enforces per-software / per-process ACLs ("app X wants to access your password for Y, do you want to allow?"). Pidgin (and other multi-platform software) tends to be resisting to this because it requires even more OS-specific code to be added and tested.
aaren 13y ago
There is a plugin to interface with gnome-keyring: https://code.google.com/p/pidgin-gnome-keyring/ https://code.google.com/p/pidgin-gnome-keyring/
kcbanner 13y ago
Some protocols use OAuth, such as Twitter.
X4 13y ago
Yes it still does. It's stupid and and I don't know why they didn't fix it. :(

vikas0380 13y ago

yes, they are still using the plain text passwords "Purple does not now and is not likely to encrypt the passwords in the accounts.xml file, nor is it likely to be encrypted in a future release. "

Vilkku 13y ago

There is a plugin called "Windows Credentials", which according to the description uses Windows credentials instead of saving the passwords as plaintext. I am unfortunately not exactly aware of what this means in practice, but I doubt it is worse than the default behaviour. But for Windows only, one could assume.

nodata 13y ago

The file it saves your password in is only readable by you. Pidgin needs to supply the plaintext password to the server to authenticate.

lucian1900 13y ago

libpurple saving passwords in plain text is the correct decision. If it did encrypt them, it would also have to hold the key, so it would only add a false sense of security. The only improvement would be a hardware-backed secret storage mechanism, but those aren't exactly ubiquitous.

giovannibajo1 13y ago
It isn't. The correct decision would be to save the password in the operating system keychain, like Empathy does (or Messages on Mac, or name any others). Browsers also use keychains. On Windows, you can use the Crypto API to obtain an intermediate level of security.
- tszming 13y ago
  >> Browsers also use keychains Google will disagree with you: chrome://settings/passwords
  - Bakkot 13y ago
    I'm still required to unlock my keychain to view the passwords (on OS X).
  - giovannibajo1 13y ago
    That's not disagreement. Those passwords are stored in the keychain.
cradle 13y ago
They're not the only options, passphrase encrypted local password storage is an option. That's no false sense of security.
meowface 13y ago
Firefox can store passwords using a master key to unlock it, yet that master key is stored securely (via hashing). libpurple/Pidgin could absolutely provide a more secure alternative by either using an OS keyring, or following Firefox's approach and requiring the user to type in a master password every time they start the client.
- reubenmorais 13y ago
  FWIW, Firefox doesn't do it by default, the option to enable it is not prominent, and when you do enable it the UX is pretty bad. IIRC usage stats is way below 1% of users.
smtddr 13y ago
>>$SOFTWARE_NAME saving passwords in plain text is the correct decision. Is there any situation where this sentence would be true?
- giovannibajo1 13y ago
  No, it isn't. It's a very very bad security mistake, and I honestly thought it was obvious to most people by now (it used to be "debatable" 6-10 years ago). People disagreeing tend to reply with blanket sentences like "if there is a process reading the files owned by you on your computer, you're already doomed", ignoring that security is made always made by layered levels, it's not an black/white issue. A file on disk could for instance end up in an unencrypted backup that goes into a server which is then exploited; it could be in a VM where you cannot control the supervisors. It might be end up being mailed to yourself for mistake while migrating computers (I know many people who do it), and thus being stored on remote servers; you might be running on a NFS-based deployment where you don't want to necessarily trust all present and future sysadmins with your personal passwords. What's worse is that there is an alternative, safe solution to this which is using the operating system keyring, which stores passwords fully encrypted, and also enforces per-software / per-process ACLs ("app X wants to access your password for Y, do you want to allow?"). Pidgin (and other multi-platform software) tends to be resisting to this because it requires even more OS-specific code to be added and tested.

aaren 13y ago

There is a plugin to interface with gnome-keyring: https://code.google.com/p/pidgin-gnome-keyring/ https://code.google.com/p/pidgin-gnome-keyring/

kcbanner 13y ago

Some protocols use OAuth, such as Twitter.

X4 13y ago

Yes it still does. It's stupid and and I don't know why they didn't fix it. :(