Re: Fwd: storing and using sensitive data

well, i ran into a major snag.
https://github.com/gbirke/rememberme doesn't store plaintext passwords, but
i do need a plaintext password to gain access to the database that i'm
using.
it's a real chicken-and-egg problem i'm afraid.

i suppose i could store the plaintext password in a file on the server
which i'd read into / store in $_SESSION once a user has succesfully logged
in by providing the username and password, or when the user is logged in
with a rememberme cookie, which would give me only the username to get to a
username->plaintext password file protected with chmod 770 and chown
rene:www-data...
but i have serious reservations about security when using a scheme like
this. ubuntu security holes in apache2 and/or PHP happen just about every 2
years, when the ubuntu.com guys focus on making a new major release, and i
since i'm storing more than just theme settings (IMAP credentials and
passwords for my webmail app), i'm hoping someone here can point me to a
more secure solution..

On Fri, Aug 6, 2021 at 9:52 PM Ashley Sheridan <[email protected]>
wrote:

>
> On 06/08/2021 16:42, Rene Veerman wrote:
>
> Rene Veerman 5864 <https://support.google.com/profile/120150990> Original
> Poster
> 9 min
> eh, on windows 10, my username and password *are* filled in by autofill.
>
> but on my development machine, a kubuntu installation, it does not.
>
> i hope this is of help to google support..
> Rene Veerman 5864 <https://support.google.com/profile/120150990> Original
> Poster
> 4 sec
> nvm! fixed by following the advice listed at
> https://askubuntu.com/a/1185476 :)
>
> ---------- Forwarded message ---------
> From: Rene Veerman <[email protected]>
> Date: Fri, Aug 6, 2021 at 1:05 PM
> Subject: Fwd: storing and using sensitive data
> To: PHP General <[email protected]>
>
>
> FYI :
> i've read
> https://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach
> which explains a lot of the pitfalls involved,
> then i went searching for a library that does this for you, and found
> https://github.com/gbirke/rememberme which appears to work great right of
> the box.
>
> i'm now stuck at the autofill functionality.
> my site https://nicer.app, with the login button at the top-left of the
> pages, the middle icon on the right-side of the date-time indicator,
> just won't autofill at all, other than offering a multitude of previously
> used usernames, but i can't for the love of anything get it to autofill the
> password field.
>
> this is the same for <input type="password" id="password" name="password">
> and <input type="password" id="current-password" name="current-password">
>
> i could really use some help with that..
>
> ---------- Forwarded message ---------
> From: Rene Veerman <[email protected]>
> Date: Thu, Aug 5, 2021 at 6:30 PM
> Subject: storing and using sensitive data
> To: PHP General <[email protected]>
>
>
> Hi.
>
> I'm building a webmail module for my MIT-licensed
> https://github.com/nicerapp/nicerapp websites platform (CMS and more, see
> https://nicer.app for a demo).
>
> I don't want to store end-user's email connection settings in plain text
> on my server.
>
> I've read all of https://github.com/defuse/php-encryption, understand
> most of it, but wonder if I can just encrypt the data using the end-user's
> password, which gets verified by couchdb and as such is only stored as a
> hash value in the database.
>
> Will my SSL connection setup, and the password stored in a cookie in the
> end-user's browser, keep things safe enough to survive a PHP/apache-based
> intrusion, which tends to open up every 2 years when the guys at
> ubuntu.com prepare for a new release..
>
> With regards,
>   Rene Veerman
>
>
> Autofill tends to work based on the name and id of the field in question,
> and this behaviour varies quite a bit between browsers and operating
> systems. Have you looked at the `autocomplete` attribute (
> https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete)
> for that form element? In theory, you _should_ be able to set that to
> "current-password" to trigger the autocomplete behaviour. However, this is
> not a guarantee, it's just an attribute which suggests to the browser to do
> that, not an instruction that the browser must follow.
>
> --
> Ashley Sheridanhttps://www.ashleysheridan.co.uk
>
>