Re: Fwd: storing and using sensitive data

nvm!! :) :) my db (couchdb.apache.org) supports cookie authentication, which is like the rememberme PHP plugin, just another hash value transmitted! :) looks like i have an actually secure setup for my https://github.com/nicerapp/nicerapp by tomorrow morning :D On Sun, Aug 8, 2021 at 6:13 PM Rene Veerman < rene.veerman.netherlands@gmail.com> wrote: > well, i ran into a major snag. > https://github.com/gbirke/rememberme doesn't store > plaintext passwords, > but i do need a plaintext password to gain access to the database that i'm > using. > it's a real chicken-and-egg problem i'm afraid. > > i suppose i could store the plaintext password in a file on the server > which i'd read into / store in $_SESSION once a user has succesfully logged > in by providing the username and password, or when the user is logged in > with a rememberme cookie, which would give me only the username to get to a > username->plaintext password file protected with chmod 770 and chown > rene:www-data... > but i have serious reservations about security when using a scheme like > this. ubuntu security holes in apache2 and/or PHP happen just about every 2 > years, when the ubuntu.com guys focus on making a new major release, and > i since i'm storing more than just theme settings (IMAP credentials and > passwords for my webmail app), i'm hoping someone here can point me to a > more secure solution.. > > On Fri, Aug 6, 2021 at 9:52 PM Ashley Sheridan <ash@ashleysheridan.co.uk> > wrote: > >> >> On 06/08/2021 16:42, Rene Veerman wrote: >> >> Rene Veerman 5864 >> <https://support.google.com/profile/120150990> Original >> Poster >> 9 min >> eh, on windows 10, my username and password *are* filled in by autofill. >> >> but on my development machine, a kubuntu installation, it does not. >> >> i hope this is of help to google support.. >> Rene Veerman 5864 >> <https://support.google.com/profile/120150990> Original >> Poster >> 4 sec >> nvm! fixed by following the advice listed at >> https://askubuntu.com/a/1185476 :) >> >> ---------- Forwarded message --------- >> From: Rene Veerman <rene.veerman.netherlands@gmail.com> >> Date: Fri, Aug 6, 2021 at 1:05 PM >> Subject: Fwd: storing and using sensitive data >> To: PHP General <php-general@lists.php.net> >> >> >> FYI : >> i've read >> >> https://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach >> which explains a lot of the pitfalls involved, >> then i went searching for a library that does this for you, and found >> https://github.com/gbirke/rememberme which appears to work >> great right >> of the box. >> >> i'm now stuck at the autofill functionality. >> my site https://nicer.app, with the login button at the >> top-left of the >> pages, the middle icon on the right-side of the date-time indicator, >> just won't autofill at all, other than offering a multitude of previously >> used usernames, but i can't for the love of anything get it to autofill the >> password field. >> >> this is the same for <input type="password" id="password" >> name="password"> and <input type="password" >> id="current-password" >> name="current-password"> >> >> i could really use some help with that.. >> >> ---------- Forwarded message --------- >> From: Rene Veerman <rene.veerman.netherlands@gmail.com> >> Date: Thu, Aug 5, 2021 at 6:30 PM >> Subject: storing and using sensitive data >> To: PHP General <php-general@lists.php.net> >> >> >> Hi. >> >> I'm building a webmail module for my MIT-licensed >> https://github.com/nicerapp/nicerapp websites platform (CMS >> and more, >> see https://nicer.app for a demo). >> >> I don't want to store end-user's email connection settings in plain text >> on my server. >> >> I've read all of >> https://github.com/defuse/php-encryption, understand >> most of it, but wonder if I can just encrypt the data using the end-user's >> password, which gets verified by couchdb and as such is only stored as a >> hash value in the database. >> >> Will my SSL connection setup, and the password stored in a cookie in the >> end-user's browser, keep things safe enough to survive a PHP/apache-based >> intrusion, which tends to open up every 2 years when the guys at >> ubuntu.com prepare for a new release.. >> >> With regards, >> Rene Veerman >> >> >> Autofill tends to work based on the name and id of the field in question, >> and this behaviour varies quite a bit between browsers and operating >> systems. Have you looked at the autocomplete attribute ( >> >> https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete) >> for that form element? In theory, you _should_ be able to set that to >> "current-password" to trigger the autocomplete behaviour. However, this is >> not a guarantee, it's just an attribute which suggests to the browser to do >> that, not an instruction that the browser must follow. >> >> -- >> Ashley Sheridanhttps://www.ashleysheridan.co.uk >> >>