tylerhall / MacSosumi

Desktop Find My iPhone client for Mac OS X.
http://clickontyler.com/sosumi/
100 stars 23 forks source link

Insecure storage of passwords #10

Closed tekacs closed 13 years ago

tekacs commented 13 years ago

Disclaimer: I'm incredibly paranoid (but this probably needs fixing anyway).

I had an account issue with Sosumi, where it duplicated one of my accounts unnecessarily. Upon inspecting the preference file, I discovered that my Apple account password was being stored in plain text, despite assurance that it would be stored in the Keychain! Upon deleting just the password (and leaving the username intact) I found that Sosumi continued to run as usual (because it fetches the password from the Keychain).

Edit:

I've in fact now gone and put together a 'fixed' version, which works fine, with very few changes - hopefully you'll be satisfied and merge it in! I haven't added anything to fix existing preferences, however. It'd be very helpful if you could either upgrade the preferences on startup or warn users of this bug such that they can purge the plaintext password from their disks (although I'm off to remove it from my Time Machine backups as well...) :S

tylerhall commented 13 years ago

Fixed

tekacs commented 13 years ago

Thanks for this! :)