You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
When I paste my piHole API key in the extension settings the key stays visible in plaintext for all other users who might using my browser and visiting the extension setting section. And everybody is able to copy/paste the key. I think this is a big security concern.
Describe the solution you'd like
I think the solution to the issue is, to change the type of the input field to "password", so that the api key is shown as dots and to stop the possibility to paste the key out of the form.
The text was updated successfully, but these errors were encountered:
Mhh, I will think about it, but this is basically 'security by obscurity'.
Everybody in your network can sniff for the API Key, because the requests to the pihole are not secured.
And if someone has access to your pc or browser, every security mechanism in a chrome extension can be exploited, because there are no severs securing it.
But nevertheless I will make some thoughts about that.
Is your feature request related to a problem? Please describe.
When I paste my piHole API key in the extension settings the key stays visible in plaintext for all other users who might using my browser and visiting the extension setting section. And everybody is able to copy/paste the key. I think this is a big security concern.
Describe the solution you'd like
I think the solution to the issue is, to change the type of the input field to "password", so that the api key is shown as dots and to stop the possibility to paste the key out of the form.
The text was updated successfully, but these errors were encountered: