{"action":"created","issue":{"url":"https://api.github.com/repos/Dwolla/dwolla-token-generator/issues/6","labels_url":"https://api.github.com/repos/Dwolla/dwolla-token-generator/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/Dwolla/dwolla-token-generator/issues/6/comments","events_url":"https://api.github.com/repos/Dwolla/dwolla-token-generator/issues/6/events","html_url":"https://github.com/Dwolla/dwolla-token-generator/issues/6","id":125056842,"number":6,"title":"Saving app secret to localStorage probably a bad idea","user":{"login":"davidmurdoch","id":187813,"avatar_url":"https://avatars.githubusercontent.com/u/187813?v=3","gravatar_id":"","url":"https://api.github.com/users/davidmurdoch","html_url":"https://github.com/davidmurdoch","followers_url":"https://api.github.com/users/davidmurdoch/followers","following_url":"https://api.github.com/users/davidmurdoch/following{/other_user}","gists_url":"https://api.github.com/users/davidmurdoch/gists{/gist_id}","starred_url":"https://api.github.com/users/davidmurdoch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidmurdoch/subscriptions","organizations_url":"https://api.github.com/users/davidmurdoch/orgs","repos_url":"https://api.github.com/users/davidmurdoch/repos","events_url":"https://api.github.com/users/davidmurdoch/events{/privacy}","received_events_url":"https://api.github.com/users/davidmurdoch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-01-05T21:37:49Z","updated_at":"2016-01-07T18:03:39Z","closed_at":null,"body":"Love this app! I've got an app that has no UI (and no need for one), and this has saved me tons of time generating the initial access tokens. However, for security reasons I don't think the app secret should be saved to localStorage, at least not without opting in. I use 2FA and strong passwords for everything under the sun, but now my browser has everything an attacker needs to completely drain my Dwolla funds!\r\n\r\nWhat do you think about adding a check box like \"Remember Application Key and Secret\"?"},"comment":{"url":"https://api.github.com/repos/Dwolla/dwolla-token-generator/issues/comments/169758136","html_url":"https://github.com/Dwolla/dwolla-token-generator/issues/6#issuecomment-169758136","issue_url":"https://api.github.com/repos/Dwolla/dwolla-token-generator/issues/6","id":169758136,"user":{"login":"benjschmitt","id":13003571,"avatar_url":"https://avatars.githubusercontent.com/u/13003571?v=3","gravatar_id":"","url":"https://api.github.com/users/benjschmitt","html_url":"https://github.com/benjschmitt","followers_url":"https://api.github.com/users/benjschmitt/followers","following_url":"https://api.github.com/users/benjschmitt/following{/other_user}","gists_url":"https://api.github.com/users/benjschmitt/gists{/gist_id}","starred_url":"https://api.github.com/users/benjschmitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benjschmitt/subscriptions","organizations_url":"https://api.github.com/users/benjschmitt/orgs","repos_url":"https://api.github.com/users/benjschmitt/repos","events_url":"https://api.github.com/users/benjschmitt/events{/privacy}","received_events_url":"https://api.github.com/users/benjschmitt/received_events","type":"User","site_admin":false},"created_at":"2016-01-07T18:03:39Z","updated_at":"2016-01-07T18:03:39Z","body":"@davidmurdoch - glad you like this application and the time savings it can provide to those who choose to use it.  We also believe that options are a good thing and your suggestion for a changed default behavior and optional storage of ***API key/secret*** is valid.  This change is in-progress and you should see the update soon.\r\n\r\n@mach-kernel - also glad you helped show the strengths of how **tokens*** can be and are protected.  \r\n\r\nWhen looking at both comments, it appears we are speaking about somewhat different things (short-lived tokens vs. application credentials) both with valid concerns and considerations.  Hoping that the option and behavior change for API key/secret storage shows our commitment to giving customers options and reinforces the existing strengths surrounding token security."}}