Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feature request] Abillity to skip master password #309

Closed
Gieted opened this issue Aug 1, 2020 · 4 comments
Closed

[feature request] Abillity to skip master password #309

Gieted opened this issue Aug 1, 2020 · 4 comments

Comments

@Gieted
Copy link

Gieted commented Aug 1, 2020

First thing what you see after installation of ElectronMail is a prompt to set a master password. Why you even need one?
Why not just store the secrets in OS services (or add an option to)?
What you mean by saying "Saving the master password on computer weakens the security."? Most desktop programs actually don't log you out after a restart (including privacy/security ones, like signal-desktop) and don't require any additional password, so why ElectronMail shows a red warning, such as it could lead to a security disaster?
Does saving the master password actually increase my security, when I'm using full disk encryption (BitLocker)?

@vladimiry
Copy link
Owner

Master password skipping request gets rejected since all the sensitive app settings and data if the local store option enabled need to be stored encrypted (see the Data/config files created and used by the app section in readme).

Master password saving option is added for those who prefer the convenience of storing the master password in the system's keychain which makes the fully automated login into the app and email accounts possible (done using keytar native module).

I'd recommend exploring the app capabilities on your own since I believe then many of your questions will be taken off the agenda. You might also want to explore the persistent session feature.

@Gieted
Copy link
Author

Gieted commented Aug 1, 2020

all the sensitive app settings and data if the local store option enabled need to be stored encrypted

You can encrypt them with a random key and store it in system keychain (I think most of desktop apps are doing so).

My proposal is to encrypt user's data with a random key by default and add setting a master password as an option in settings.
Many programs are doing so, e.g. Firefox.

compulsory password + "keep me singed in" checkbox is just not used when it comes to desktop apps, ElectronMail should follow this convention in order to be more friendly to non-technical users

@vladimiry
Copy link
Owner

My proposal is to encrypt user's data with a random key by default and add setting a master password as an option in settings.
Many programs are doing so, e.g. Firefox.

This would make the app less secure by default since currently the master password/key by default is not saved anywhere and enabling saving behavior requires the option to be explicitly activated by the user. I understand why Firefox and alike programs follow the way you described but for this project I prefer it to act like it's done now.

Besides that, there are scenarios when the app won't be able to save anything in the system's keychain since there is no keychain provider installed on the system. See #57 (comment) for details if interested.

ElectronMail should follow this convention in order to be more friendly to non-technical users

I'm going to make the master password setup form more informative to let non-technical users become more technical.

strip 2

@vladimiry
Copy link
Owner

vladimiry commented Aug 3, 2020

Pushed to master warning message:

Activating "Keep me signed in" option enables saving the master password in the system's keychain. In general, storing the password on computer weakens the security but enables automatic login to the app so you don't have to manually enter the master password each time you start the app.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants