Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't leak passwords in Android logs #83

Closed
licaon-kter opened this issue Dec 9, 2019 · 2 comments
Closed

Don't leak passwords in Android logs #83

licaon-kter opened this issue Dec 9, 2019 · 2 comments
Labels
bug Something isn't working

Comments

@licaon-kter
Copy link
Contributor

licaon-kter commented Dec 9, 2019 •
edited
Loading

info.varden.hauk: .utils.PreferenceManager.set(PreferenceManager.java:42): Setting preference Preference<String+Encrypted>{key=cryptPassword,default=}, value=MYSERVERPASSWORDINPLAINTEXT

and

I info.varden.hauk: .caching.ResumableSessions.setSessionResumable(ResumableSessions.java:80): Setting session Session{serverURL=https://domain.tld/,backendVersion=1.5,sessionID=xxxxxxxxxxxxxxxxxxxxxxxxx,expiry=15759074xxxxx,interval=5,e2eParams=KeyDerivable{password=MYE2ESHAREPASSWORDINPLAINTEXT,salt=0xxxxxxxxxxxxxxxxxxxxxxxxxxxx}} resumable
@licaon-kter licaon-kter changed the title Don't leak e2e password in Android logs Don't leak passwords in Android logs Dec 9, 2019
@bilde2910
Copy link
Owner

That's a very good point. I'll remove the password from the logs. The salt is randomly generated and not considered secret.

@bilde2910 bilde2910 added the bug Something isn't working label Dec 9, 2019
@bilde2910
Copy link
Owner

Fixed in upcoming v1.5.2.

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@licaon-kter @bilde2910