{"action":"created","issue":{"url":"https://api.github.com/repos/mRemoteNG/mRemoteNG/issues/1140","repository_url":"https://api.github.com/repos/mRemoteNG/mRemoteNG","labels_url":"https://api.github.com/repos/mRemoteNG/mRemoteNG/issues/1140/labels{/name}","comments_url":"https://api.github.com/repos/mRemoteNG/mRemoteNG/issues/1140/comments","events_url":"https://api.github.com/repos/mRemoteNG/mRemoteNG/issues/1140/events","html_url":"https://github.com/mRemoteNG/mRemoteNG/issues/1140","id":369016955,"node_id":"MDU6SXNzdWUzNjkwMTY5NTU=","number":1140,"title":"Critical Bug: Passwords are saved in plain text in SQL Database","user":{"login":"pthoelken","id":12643853,"node_id":"MDQ6VXNlcjEyNjQzODUz","avatar_url":"https://avatars2.githubusercontent.com/u/12643853?v=4","gravatar_id":"","url":"https://api.github.com/users/pthoelken","html_url":"https://github.com/pthoelken","followers_url":"https://api.github.com/users/pthoelken/followers","following_url":"https://api.github.com/users/pthoelken/following{/other_user}","gists_url":"https://api.github.com/users/pthoelken/gists{/gist_id}","starred_url":"https://api.github.com/users/pthoelken/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pthoelken/subscriptions","organizations_url":"https://api.github.com/users/pthoelken/orgs","repos_url":"https://api.github.com/users/pthoelken/repos","events_url":"https://api.github.com/users/pthoelken/events{/privacy}","received_events_url":"https://api.github.com/users/pthoelken/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-10-11T08:52:55Z","updated_at":"2018-10-23T06:15:24Z","closed_at":null,"author_association":"NONE","body":"Hey All, \r\n\r\nI'm absolutely shocked about the fact, that your software are saved the connection passwords in plain text in the database. \r\n\r\n![image](https://user-images.githubusercontent.com/12643853/46792455-b0f2b880-cd43-11e8-922e-0acf7133dc6c.png)\r\n\r\nSo you can do it! The passwords for connections in confCons.xml are also encrypted. Do it in SQL Database too, please! \r\n\r\nBest rgds\r\nPatrick\r\n"},"comment":{"url":"https://api.github.com/repos/mRemoteNG/mRemoteNG/issues/comments/432107526","html_url":"https://github.com/mRemoteNG/mRemoteNG/issues/1140#issuecomment-432107526","issue_url":"https://api.github.com/repos/mRemoteNG/mRemoteNG/issues/1140","id":432107526,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMjEwNzUyNg==","user":{"login":"pthoelken","id":12643853,"node_id":"MDQ6VXNlcjEyNjQzODUz","avatar_url":"https://avatars2.githubusercontent.com/u/12643853?v=4","gravatar_id":"","url":"https://api.github.com/users/pthoelken","html_url":"https://github.com/pthoelken","followers_url":"https://api.github.com/users/pthoelken/followers","following_url":"https://api.github.com/users/pthoelken/following{/other_user}","gists_url":"https://api.github.com/users/pthoelken/gists{/gist_id}","starred_url":"https://api.github.com/users/pthoelken/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pthoelken/subscriptions","organizations_url":"https://api.github.com/users/pthoelken/orgs","repos_url":"https://api.github.com/users/pthoelken/repos","events_url":"https://api.github.com/users/pthoelken/events{/privacy}","received_events_url":"https://api.github.com/users/pthoelken/received_events","type":"User","site_admin":false},"created_at":"2018-10-23T06:15:24Z","updated_at":"2018-10-23T06:15:24Z","author_association":"NONE","body":"mRemoteNG saves their saved connection passwords (for ssh, rdp or other) in plain text, when you use the MSSQL connection for configuration saving. If you want to save the connection bookmarks locally, the passwords are encrypted. \r\n\r\nSo I ask me, why mRemote encrypt the local saved configuration files, but not the stored passwords in the database. This is fucking basic programming stuff. \r\n\r\nFor Repo: \r\n\r\n1. Setup your mRemoteNG for saving your bookmarks in MSSQL (Create Table, setup connection settings, etc)\r\n2. Go into your MSSQL Database (via MSSMS or other) and navigate to your password. \r\n3. You can see, that the connection password is stored in plaintext in the database. "}}
{"actor":{"display_login":"pthoelken"}}