vspd icon indicating copy to clipboard operation
vspd copied to clipboard

config: Consider not storing admin pass in plain text.

Open JoeGruffins opened this issue 4 years ago • 0 comments

https://github.com/decred/vspd/blob/e42b1cad330596c243baf4c391dc40c981f4de90/config.go#L66

Per SEI CERT C Coding Standard it is best practice not to store plain text passwords in memory or on disk. This could be removed from memory, mostly, by storing the sha256 hash of the admin pass, and constant-time comparing the hashes of incoming passwords. For input on startup, the secure terminal could (optionally) be used which works without a gui to input the pass every start-up.

JoeGruffins avatar Jun 24 '21 06:06 JoeGruffins