search

eshaham / israeli-ynab-updater

A tool for updating YNAB using israeli-bank-scrapers
MIT License
53 stars 15 forks source link

Credentials Encryption #37

Closed GuyLewin closed 5 years ago

GuyLewin commented 5 years ago

Regarding the following code: https://github.com/eshaham/israeli-ynab-updater/blob/5b0399ca3c3d2842a2e392a0eb14939c551e8438/src/helpers/crypto.js#L3-L10

Even if the credentials are encrypted with AES with a preconfigured key, it's still decryptable by simply the file (since the key is on GitHub).

How about moving to using system's keychain management instead? With a cross-platform library such as keytar

GuyLewin commented 5 years ago

You can look at my code for configuring the accounts that is based on this project's setup.

eshaham commented 5 years ago

Agreed, duplicate of #34 Since this tool is being used locally on the user's workstation, it's not critical in my opinion. Yet again, we need to fix it - PR is welcome!