search

himanshub16 / ProxyMan

Configuring proxy settings made easy.
https://github.com/himanshub16/ProxyMan/releases/latest/
MIT License
683 stars 108 forks source link

Cypher Passwords on config files and erase them from environment variables #97

Open afvacoss opened 4 years ago

afvacoss commented 4 years ago

Hello,

First of all, thank you for suach a great product, very useful in our day to day.

I have a security concern, could it be possible to cypher with an strong cypher algorithm the passwords stored in configuration files and don't use them as environment variables ?

Is quite a big vulnerability to store passwords in clear text in configuration files and even more to be able to access them in environment variables

Cheers

himanshub16 commented 4 years ago

Hi @afvacoss ,

I'm really glad that this tool is helping you in your day-to-day work.

Storing passwords in plain text in configuration files is really a security vulnerability. The part I feel sorry about is that there are no solutions to them in my knowledge. Other tools using proxy values from environment would be depending on the plain text value.

For my usage on public machines, I use proxyman to set proxy without userid/password and try to log-in via browser (my proxy allows that). Most tools today are good enough to just honour the proxy from environment and work when the session is already alive.

This definitely depends on proxy config, but I think most cases should allow setting proxy without auth and authenticate via some way as browser.

Passwords are by design bad and that's the reason solutions as password vault, 2FA, yubikeys etc exist, but that's a talk for another day. Can't really help.

Let me know your comments/concerns.