Ticket modified by Ralf Becker at 2010/12/03 17:49
Tracking System: Bugs
Category: FelamiMail
Version: Version 1.6 (unsupported)
Status: Pending
Resolution: None
Completed: 0%
Priority: 5 - medium
Created By: Pierre Wirtz
Assigned to: Klaus Leithoff
Summary: #1894 - Felamilail stores clear passwords in DB
Felamimail stores users’ mails accounts in table “egw_felamilail_accounts”, no problems with that. But in this table, felamimail stores the two passwords (POP/IMAP and SMTP) in plain text in fields “fm_ic_password” and “fm_og_password”. Isn’t it possible to store it at least with reversible encryption so it is not left open to the whole world ?
Comment by Ralf Becker at 2010/12/03 17:49:
Dear EGroupware user,
thanks for reporting bugs back to egroupware.org.
With the new release of EGroupware 1.8.001 we also fixed many bugs. So we kindly ask you to recheck your bug reports against the new version.
If you do not respond within the next 14 days, we assume the bug no longer exist and your report will be closed automatically.
Thanks for your understanding
Ralf Becker
Stylite GmbH
Comment by Klaus Leithoff at 2009/09/10 12:25:
I agree, and I do have a look, as soon as I have some free time.
Comment by Se Lip at 2009/09/10 11:57:
Thank you for the hint!
Same problem in our company. We use “single-sign-on” so that seeing the plain text mail password means to get access to other accounts of this user.
For security reasons the password should be stored encrypted.
Comment by Klaus Leithoff at 2009/01/13 14:10:
since you want to be able to decrypt the password, to be able to send it to the smtp/imap server,
anything done here is only to prevent the abuse/use on first sight. It will not be a worthwhile
security measure.
anyhow, I think about it.
linked entries:
http://www.egroupware.org/egroupware/index.php?menuaction=tracker.tracker_ui.edit&tr_id=1894&no_popup=1