{"action":"opened","issue":{"url":"https://api.github.com/repos/rapid7/awsaml/issues/66","repository_url":"https://api.github.com/repos/rapid7/awsaml","labels_url":"https://api.github.com/repos/rapid7/awsaml/issues/66/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/awsaml/issues/66/comments","events_url":"https://api.github.com/repos/rapid7/awsaml/issues/66/events","html_url":"https://github.com/rapid7/awsaml/issues/66","id":163234009,"number":66,"title":"Make potentially sensitive information hidden by default","user":{"login":"rhodgman-r7","id":4821087,"avatar_url":"https://avatars.githubusercontent.com/u/4821087?v=3","gravatar_id":"","url":"https://api.github.com/users/rhodgman-r7","html_url":"https://github.com/rhodgman-r7","followers_url":"https://api.github.com/users/rhodgman-r7/followers","following_url":"https://api.github.com/users/rhodgman-r7/following{/other_user}","gists_url":"https://api.github.com/users/rhodgman-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/rhodgman-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhodgman-r7/subscriptions","organizations_url":"https://api.github.com/users/rhodgman-r7/orgs","repos_url":"https://api.github.com/users/rhodgman-r7/repos","events_url":"https://api.github.com/users/rhodgman-r7/events{/privacy}","received_events_url":"https://api.github.com/users/rhodgman-r7/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-06-30T18:34:07Z","updated_at":"2016-06-30T18:34:07Z","closed_at":null,"body":"When I start an awsaml session I get a window that looks like the following:\r\n\r\n![screen shot 2016-06-30 at 2 18 22 pm](https://cloud.githubusercontent.com/assets/4821087/16499390/4b139f4e-3ece-11e6-9740-8d2c3fad0d1a.png)\r\n\r\nNot that this is a very likely attack vector, but with that window up, someone could capture the information in that window (with a camera? a really good memory?) and then transfer it to another device and use AWS services impersonating me.\r\n\r\nSince awsml conveniently writes that data to ~/.aws/credentials already, it also seems unlikely that anyone would really need to copy and paste it from the awsaml GUI to somewhere else.\r\n\r\nSo, would you consider a modification in which the access key, secret key and session token info is hidden by default in the awsaml GUI, but could be revealed after clicking on a button?\r\n"}}
{"actor":{"display_login":"rhodgman-r7"}}