• 2 Posts
  • 60 Comments
Joined 1 year ago
cake
Cake day: July 2nd, 2023

help-circle






  • It’s actually by design. First of all they shot themselves in the foot by choosing Electron as platform to build desktop applications as Electron has no integration with the rest of the system, at least not as deep as native application has. Both Linux and, I believe, MacOS have secure storage programs for keys and passwords. Windows however does not, at least it didn’t back when we got screwed. So this is another reason why they chose to store in clear text, you have to cater to largest audience no matter how dumb the solution is.

    In its truest sense this is what a technical debt is. Shitty choice costing you increasingly more as the time goes on and now they are simply too deep to pull out. They are committed to this approach and simply switching would require too much money and effort.

    And you are right, it’s 100% security hole and a juicy attack vector. FileZilla did the same thing and there’s malware out there specifically targeting this software and is using user’s servers for propagation. Our systems got infected the same way long time ago because one of employees was retarded enough to use FileZilla and save password in config file even though I said not to. Since password was saved in clear text format and FTP is not terribly hard protocol to implement we got screwed. After that incident when our servers were almost taken down from internet, FTP was banned and any form of password login without two factors.