Secure Storage of OpenAI API Key

[ericrallen]

Obsidian currently does not have a good way to ensure that secrets like API keys are stored securely.

In this case "good" is defined as cross-platform, secure storage of a string that prevents access from any unauthorized or unexpected actors.

By default, many plugins store things like API Keys in plaintext in the data.json, which means that any plugin with access to the Obsidian object, and any code with access to the user's filesystem, has access to the API Key.

This plugin, the Obsidian AI Research Assistant, also currently stores the user's OpenAI API Key in this way - which is why it hasn't been submitted to the Community Plugins listing yet.

Electron provides a safeStorage method that Obsidian exposes to us via the safeStorage API, but from my understanding this still allows other plugins to call safeStorage.decryptString().

Given that eventually this plugin wants to support mobile, there needs to a be a longer term solution for this, but temporarily, we should move to using safeStorage for at least a slightly more secure implementation.

We should also add a warning to the plugin Settings interface that lets the user know that they need to be wary of what other plugins they install might be doing in terms of calling decryptString() on these API keys.

Maybe we can find a way to monkey patch the decryptString method to require consent from the user to decrypt the requested string?

[github-actions]

🎉 This issue has been resolved in version 1.4.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀