2020-12-27 18:05

Password is stored in cleartext

The password is stored in cleartext in ~/.config/DeltaChat/config.json file.

  • Platform (linux/mac/windows): linux
  • Delta Chat Desktop Version: 0.101.0-x86_64
  • Expected behavior: The password must be stored in system keyring or encrypted
  • Actual behavior: The password is stored in cleartext (unencrypted)
  • Steps to reproduce the problem: cat ~/.config/DeltaChat/config.json
  • Screenshots: -
  • Logs: -


  • 点赞
  • 写回答
  • 关注问题
  • 收藏
  • 复制链接分享
  • 邀请回答


  • weixin_39638012 weixin_39638012 4月前

    Storing in the Mac keyring seems to be straight forward, but how should encryption be used to protect the credentials on the other systems? I mean if you encrypt it, the application must also store the key and that one can be used by attackers to decrypt the credentials which results in no more protection what so ever.

    I personally see the mac key-chain as reasonable secure, but I wouldn't trust its windows equivalent.

    Also currently the messages and logs are also still unencrypted. Our thought for the beta was that the user is responsible for securing its local data. But you're right - at least the email credentials should be stored more securely than they are stored now. Let's discuss here which methods we should use.

    点赞 评论 复制链接分享
  • weixin_39776817 weixin_39776817 4月前

    Plaintext password is stored in db.sqlite too.

    cd ~/Library/"Application Support"/DeltaChat
    sqlite3 */db.sqlite "select * from config where keyname like '%_pw'"
    点赞 评论 复制链接分享
  • weixin_39852121 weixin_39852121 4月前

    there are rough ideas to use sqlcipher to encrypt the whole database, see https://github.com/deltachat/deltachat-core/issues/194

    for android the app-states are completely separated; for linux/mac, however, at least the account is separated from the access from others users. not sure what the current state on windows is.

    点赞 评论 复制链接分享
  • weixin_39852121 weixin_39852121 4月前

    just checked ~/.config/DeltaChat/config.json on my machine using delta 0.101.0: the password is not stored there, just a true/false flag.

    点赞 评论 复制链接分享
  • weixin_39717692 weixin_39717692 4月前

    Encrypting the whole database would be a nice idea. The password for the account as well as the encryption key should be stored safely though.

    I've found this npm package that seems to integrate well with keychains on all 3 platforms: https://atom.github.io/node-keytar/

    点赞 评论 复制链接分享
  • weixin_39852121 weixin_39852121 4月前

    thanks for the link. i also think protecting the imap-password and the private-key by the system-login-key makes some sense and does not bother the user again with a master-password or so.

    wrt master-password: found this for thunderbird: https://palant.de/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother - seems not to be so easy to handle a master-password in a secure way. and: also for thunderbird, credentials without a master password seems to be stored directly accessible. however, it's also about trusting the system and your device. it's different from storing the password unencrypted on a server or route it through the internet.

    点赞 评论 复制链接分享
  • weixin_39601929 weixin_39601929 4月前

    FTR: There is https://www.freedesktop.org/wiki/Specifications/secret-storage-spec/ which has a few implementations such as GNOME Keyring.

    点赞 评论 复制链接分享