search

penguin86 / ojo

Ojo is a basic RTSP IP Camera surveillance wall for Android
GNU General Public License v3.0
67 stars 15 forks source link

Security Enhancement: Hide connection string (which may include username / password) in main screen #34

Open nagatsoul opened 6 months ago

nagatsoul commented 6 months ago

The connection string in the IP Cameras main screen (when the app starts) can be seen. This reveals the IP / Port and any needed Username / Password for the connection to occur.

It would be nice to remove the connection string from the main screen and leave only the Camera name. The string should be seen only when editing is required. Also allowing the editing / viewing of a Camera connection string should require a password.

This password should also be changeable after the old password has been given.

This change will secure all the IP Cameras access details when the OJO app is installed for monitoring purposes (e.g in a Tablet) and is used from people other than the Cameras owner

alpenblauwtje commented 4 months ago

+1.

Especially the password should be obscured with bullets or stars. Showing the IP address or port number is not really a security problem, these are visible many apps like these. I do not fully agree the password should be seen when editing, it would be still very easy to reveal the password. When editing a password in eg. TinyCam, the password is still obscured with bullets, that is far more secure. It might require separation into several fields (like IP address, username, password, etc.) but that would be a good enhancement of the app anyway.