Re: Fwd: storing and using sensitive data

darn, i spoke too soon.

the rememberme plugin may store only a hashed cookie value for the password,
but no matter how, every time a new session is started, i need the
plaintext password to establish connections to the database.
that's whether i use the db cookie auth tech or not.

so i'm basically looking for a more secure way to store a plaintext
password than storing it on disk with chmod 770 and chown rene:www-data...

On Sun, Aug 8, 2021 at 6:26 PM Rene Veerman <
[email protected]> wrote:

> nvm!! :) :)
>
> my db (couchdb.apache.org) supports cookie authentication, which is like
> the rememberme PHP plugin, just another hash value transmitted! :)
>
> looks like i have an actually secure setup for my
> https://github.com/nicerapp/nicerapp by tomorrow morning :D
>
> On Sun, Aug 8, 2021 at 6:13 PM Rene Veerman <
> [email protected]> wrote:
>
>> well, i ran into a major snag.
>> https://github.com/gbirke/rememberme doesn't store plaintext passwords,
>> but i do need a plaintext password to gain access to the database that i'm
>> using.
>> it's a real chicken-and-egg problem i'm afraid.
>>
>> i suppose i could store the plaintext password in a file on the server
>> which i'd read into / store in $_SESSION once a user has succesfully logged
>> in by providing the username and password, or when the user is logged in
>> with a rememberme cookie, which would give me only the username to get to a
>> username->plaintext password file protected with chmod 770 and chown
>> rene:www-data...
>> but i have serious reservations about security when using a scheme like
>> this. ubuntu security holes in apache2 and/or PHP happen just about every 2
>> years, when the ubuntu.com guys focus on making a new major release, and
>> i since i'm storing more than just theme settings (IMAP credentials and
>> passwords for my webmail app), i'm hoping someone here can point me to a
>> more secure solution..
>>
>> On Fri, Aug 6, 2021 at 9:52 PM Ashley Sheridan <[email protected]>
>> wrote:
>>
>>>
>>> On 06/08/2021 16:42, Rene Veerman wrote:
>>>
>>> Rene Veerman 5864 <https://support.google.com/profile/120150990> Original
>>> Poster
>>> 9 min
>>> eh, on windows 10, my username and password *are* filled in by autofill.
>>>
>>> but on my development machine, a kubuntu installation, it does not.
>>>
>>> i hope this is of help to google support..
>>> Rene Veerman 5864 <https://support.google.com/profile/120150990> Original
>>> Poster
>>> 4 sec
>>> nvm! fixed by following the advice listed at
>>> https://askubuntu.com/a/1185476 :)
>>>
>>> ---------- Forwarded message ---------
>>> From: Rene Veerman <[email protected]>
>>> Date: Fri, Aug 6, 2021 at 1:05 PM
>>> Subject: Fwd: storing and using sensitive data
>>> To: PHP General <[email protected]>
>>>
>>>
>>> FYI :
>>> i've read
>>> https://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach
>>> which explains a lot of the pitfalls involved,
>>> then i went searching for a library that does this for you, and found
>>> https://github.com/gbirke/rememberme which appears to work great right
>>> of the box.
>>>
>>> i'm now stuck at the autofill functionality.
>>> my site https://nicer.app, with the login button at the top-left of the
>>> pages, the middle icon on the right-side of the date-time indicator,
>>> just won't autofill at all, other than offering a multitude of
>>> previously used usernames, but i can't for the love of anything get it to
>>> autofill the password field.
>>>
>>> this is the same for <input type="password" id="password"
>>> name="password"> and <input type="password" id="current-password"
>>> name="current-password">
>>>
>>> i could really use some help with that..
>>>
>>> ---------- Forwarded message ---------
>>> From: Rene Veerman <[email protected]>
>>> Date: Thu, Aug 5, 2021 at 6:30 PM
>>> Subject: storing and using sensitive data
>>> To: PHP General <[email protected]>
>>>
>>>
>>> Hi.
>>>
>>> I'm building a webmail module for my MIT-licensed
>>> https://github.com/nicerapp/nicerapp websites platform (CMS and more,
>>> see https://nicer.app for a demo).
>>>
>>> I don't want to store end-user's email connection settings in plain text
>>> on my server.
>>>
>>> I've read all of https://github.com/defuse/php-encryption, understand
>>> most of it, but wonder if I can just encrypt the data using the end-user's
>>> password, which gets verified by couchdb and as such is only stored as a
>>> hash value in the database.
>>>
>>> Will my SSL connection setup, and the password stored in a cookie in the
>>> end-user's browser, keep things safe enough to survive a PHP/apache-based
>>> intrusion, which tends to open up every 2 years when the guys at
>>> ubuntu.com prepare for a new release..
>>>
>>> With regards,
>>>   Rene Veerman
>>>
>>>
>>> Autofill tends to work based on the name and id of the field in
>>> question, and this behaviour varies quite a bit between browsers and
>>> operating systems. Have you looked at the `autocomplete` attribute (
>>> https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete)
>>> for that form element? In theory, you _should_ be able to set that to
>>> "current-password" to trigger the autocomplete behaviour. However, this is
>>> not a guarantee, it's just an attribute which suggests to the browser to do
>>> that, not an instruction that the browser must follow.
>>>
>>> --
>>> Ashley Sheridanhttps://www.ashleysheridan.co.uk
>>>
>>>