Re: Fwd: storing and using sensitive data

well, i ran into a major snag. https://github.com/gbirke/rememberme doesn't store plaintext passwords, but i do need a plaintext password to gain access to the database that i'm using. it's a real chicken-and-egg problem i'm afraid. i suppose i could store the plaintext password in a file on the server which i'd read into / store in $_SESSION once a user has succesfully logged in by providing the username and password, or when the user is logged in with a rememberme cookie, which would give me only the username to get to a username->plaintext password file protected with chmod 770 and chown rene:www-data... but i have serious reservations about security when using a scheme like this. ubuntu security holes in apache2 and/or PHP happen just about every 2 years, when the ubuntu.com guys focus on making a new major release, and i since i'm storing more than just theme settings (IMAP credentials and passwords for my webmail app), i'm hoping someone here can point me to a more secure solution.. On Fri, Aug 6, 2021 at 9:52 PM Ashley Sheridan <ash@ashleysheridan.co.uk> wrote: > > On 06/08/2021 16:42, Rene Veerman wrote: > > Rene Veerman 5864 > <https://support.google.com/profile/120150990> Original > Poster > 9 min > eh, on windows 10, my username and password *are* filled in by autofill. > > but on my development machine, a kubuntu installation, it does not. > > i hope this is of help to google support.. > Rene Veerman 5864 > <https://support.google.com/profile/120150990> Original > Poster > 4 sec > nvm! fixed by following the advice listed at > https://askubuntu.com/a/1185476 :) > > ---------- Forwarded message --------- > From: Rene Veerman <rene.veerman.netherlands@gmail.com> > Date: Fri, Aug 6, 2021 at 1:05 PM > Subject: Fwd: storing and using sensitive data > To: PHP General <php-general@lists.php.net> > > > FYI : > i've read > > https://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach > which explains a lot of the pitfalls involved, > then i went searching for a library that does this for you, and found > https://github.com/gbirke/rememberme which appears to work > great right of > the box. > > i'm now stuck at the autofill functionality. > my site https://nicer.app, with the login button at the > top-left of the > pages, the middle icon on the right-side of the date-time indicator, > just won't autofill at all, other than offering a multitude of previously > used usernames, but i can't for the love of anything get it to autofill the > password field. > > this is the same for <input type="password" id="password" > name="password"> > and <input type="password" id="current-password" > name="current-password"> > > i could really use some help with that.. > > ---------- Forwarded message --------- > From: Rene Veerman <rene.veerman.netherlands@gmail.com> > Date: Thu, Aug 5, 2021 at 6:30 PM > Subject: storing and using sensitive data > To: PHP General <php-general@lists.php.net> > > > Hi. > > I'm building a webmail module for my MIT-licensed > https://github.com/nicerapp/nicerapp websites platform (CMS and > more, see > https://nicer.app for a demo). > > I don't want to store end-user's email connection settings in plain text > on my server. > > I've read all of https://github.com/defuse/php-encryption, > understand > most of it, but wonder if I can just encrypt the data using the end-user's > password, which gets verified by couchdb and as such is only stored as a > hash value in the database. > > Will my SSL connection setup, and the password stored in a cookie in the > end-user's browser, keep things safe enough to survive a PHP/apache-based > intrusion, which tends to open up every 2 years when the guys at > ubuntu.com prepare for a new release.. > > With regards, > Rene Veerman > > > Autofill tends to work based on the name and id of the field in question, > and this behaviour varies quite a bit between browsers and operating > systems. Have you looked at the autocomplete attribute ( > > https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete) > for that form element? In theory, you _should_ be able to set that to > "current-password" to trigger the autocomplete behaviour. However, this is > not a guarantee, it's just an attribute which suggests to the browser to do > that, not an instruction that the browser must follow. > > -- > Ashley Sheridanhttps://www.ashleysheridan.co.uk > >