search

DanNixon / PlayMusicCL

A command line client for Google Play Music
Apache License 2.0
135 stars 21 forks source link

Implement getpass() for security #4

Closed deed02392 closed 11 years ago

deed02392 commented 11 years ago

from getpass import getpass

It's a pretty severe security no-no to have your password stored in plaintext, least of all your Google account, where if someone gains access to it, they could most likely go about resetting ALL your other passwords and then remove evidence they did so etc. etc..

Please consider allowing the option to provide the password interactively.

DanNixon commented 11 years ago

You make a very good point, plain text auth was one of those things that got left over from when I was first developing this (in fact this whole app is pretty much thrown together from parts of GoogleMusicRadio (where getpass() would not be possible)). I will implement a fix in which if the password fields are blank then getpass() will be used, as in some cases (Google 2-factor auth) it may not be practical to re-enter multiple passwords to start a CLI application.

DanNixon commented 11 years ago

I have updated as I said. I think plaintext will have to remain for Google app specific passwords though, it just isn't feasible to remember a password like that to enter every time the script is launched and they are designed to be disposable anyway. Of course, you are correct in regards to passwords that can be remembered that getpass() is a much better option.