[ libetpan-Feature Requests-1066323 ] Encrypt passwords in configuration file

Feature Requests item #1066323, was opened at 2004-11-14 22:23
Message generated for change (Settings changed) made by hoa
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=429699&aid=1066323&group_id=41064

Category: Configuration
Group: EtPan!
Status: Open
>Priority: 2
Submitted By: Gaël Roualland (g_roualland)
Assigned to: Nobody/Anonymous (nobody)
Summary: Encrypt passwords in configuration file

Initial Comment:
Right now, passwords for remote servers (SMTP, POP,
IMAP, NNTP....) are stored in the configuration file as
base64 encoded, that is to say in plain text.

Although the config files should not be readable by
anyone else than the user, it would be interesting to
be able to save them encrypted in the config file,
using a global key. That key would be typed by the user
on etpan startup so the passwords could be decrypted.

Suggestion of implementation :
- Use openssl crypto functions, since libetpan links
with openssl already if it's available. A simple
symetric algorithm such as blowfish should be fine
- Save the encrypted password base64 encoded too, but
with an initial prefix string that tells etpan that it
is encrypted and the algorithm. Something like
{BLOWFISH}<base64 encoded encrypted version of
password> for instance. Of course, if there is no
encryption prefix, then the password is to be treated
as plain text.
- Ask for the global key on startup, if some passwords
were found encoded.
- Allow for the user to keep passwords clear if he
wants too, and use that by default : to enable
encrypted passwords, the user has to first set the key
to encrypt them with, however if a key is known, all
passwords must be encrypted with it in the
configuration file.
- Allow the user to unset the key, and restore
passwords to plain text if he wishes to (he will then
no longer be needed to enter the key on startup).

This is what I believe do the mozilla apps at least, by
having a master key protect the several personal stuff
saved in the browser or mua.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=429699&aid=1066323&group_id=41064


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click