Add viewing password protection

[bokkoman]

Currently, everyone can see the passwords if my PC is still open.
They open the app, go to edit a connection and press the View password button.
This is very unsafe!

Describe the solution you'd like

1. Passwords can not be viewed within the app, only when typing password for first time or retyping the password. Or when you set option 2, ask for the master password when you want to view the password.
2. Option in settings to add a master password before opening the app.

[majkinetor]

This is intentional, protect your computer instead.

If somebody gets physical access to your machine, nothing can help you.

[bokkoman]

What kind of answer is this. Of course I protect my computer. But you add layers of protection.
Every password app has protection in front and this should be default.
So if this is intentional, fix it, cause it is very bad practice.
Even mRemoteMG has this feature. Plus in mRemoteMG you can't view your password either.

[bokkoman]

I have rephrased my request, perhaps that makes it more clear.

[beasthouse-au]

This is intentional, protect your computer instead.

If somebody gets physical access to your machine, nothing can help you.

If it’s intentional then that is very poor security, I’d love to see an extra layer applied as the OP has suggested. It makes sense, particularly in this day and age of cyber warfare.

[majkinetor]

No, very poor security is leaving your computer accesible.

There are number of apps that do this the same way, including web browsers.

While this certainly can be done, I consider it to have very low priority.

[bokkoman]

I've not seen a browser that does this.
Maybe netscape.

[beasthouse-au]

No, very poor security is leaving your computer accesible.

So the first layer of security fails, you think its acceptable for a lacklustre app to open you up to a plethora of other issues?

I sense a severe lack of understanding of security fundamentals from the devs on this one...

[VShawn]

@majkinetor This is different from the use case we previously discussed.

OP suggested that a secondary authentication be required to display passwords, our previous discussion was about the startup password for the app and the need to enter the password again after being away for a period of time.

I don't think the startup password for the app is very necessary, but a secondary confirmation for displaying passwords could be useful. I've had a few instances where I need let friend use my PC temporarily, and they can copy my remote system passwords directly form 1Remote if they want.

append

However, after thinking for a while, I realized that having only a secondary verification for viewing passwords will still has a problem, as my friend could simply copy my database without guessing what the password is.

So it is necessary to use the password to encrypt the database to ensure security. However, since we now support multiple databases and database sharing, there may be that two databases use different passwords, it will be a challenge for both system development and user experience.

append2

Even if the databases are encrypted, my friends could still copy my entire system environment to their PC. Then although they wouldn't be able to view the passwords, they would be able to connect to my remote system. （This is because the encrypted passwords need to be stored somewhere in the system, otherwise I would need to enter the password every time I opened 1Remote. Especially when I connect to multiple databases, I don't want to have to enter multiple passwords before I can use 1Remote.）

[bokkoman]

@majkinetor This is different from the use case we previously discussed.

OP suggested that a secondary authentication be required to display passwords, our previous discussion was about the startup password for the app and the need to enter the password again after being away for a period of time.

I don't think the startup password for the app is very necessary, but a secondary confirmation for displaying passwords could be useful. I've had a few instances where I need let friend use my PC temporarily, and they can copy my remote system passwords directly form 1Remote if they want.

append

However, after thinking for a while, I realized that having only a secondary verification for viewing passwords will still has a problem, as my friend could simply copy my database without guessing what the password is.

So it is necessary to use the password to encrypt the database to ensure security. However, since we now support multiple databases and database sharing, there may be that two databases use different passwords, it will be a challenge for both system development and user experience.

append2

Even if the databases are encrypted, my friends could still copy my entire system environment to their PC. Then although they wouldn't be able to view the passwords, they would be able to connect to my remote system. （This is because the encrypted passwords need to be stored somewhere in the system, otherwise I would need to enter the password every time I opened 1Remote. Especially when I connect to multiple databases, I don't want to have to enter multiple passwords before I can use 1Remote.）

You are correct with the appends.
Yes you can share your DB with people and they could use the stored info. This same behavior is present with mRemoteNG.

You could add a startup pass. This will apply to all DB files. So if one would share it, it would need to know that password. Because it would ask when opened.
If you you import a DB while you already have a DB with different password, it will only ask the newly added DB password once. Then saves the added DB with user's own master password.

[majkinetor]

I sense a severe lack of understanding of security fundamentals from the devs on this one...

I sense you should use another program wtih "more" security :)

There is very serious lack of understanding of security here for sure. FYI, keylogers are a thing! Please inform yourself better before accusing other people of lack of understanding.

[VShawn]

Hey everyone, let's calm down, OK? It's true that password protection is a weak point for PRemoteM. suggestions are valid, but we also acknowledge that when someone has physical access to your PC desktop, any security measure may be fail. @majkinetor @beasthouse-au Both of you are just focusing on different security points, so there's no need to blame each other.

There is also a personal taste for me. I'm too lazy to enter a password every time, so I tend to sacrifice some security for convenience (because I can almost ensure the security of my PC). That's why I haven't added startup password protection and have given this feature a low priority (to the extent that I can't find the previous discussion about the startup password now).

[bokkoman]

That's why I asked for it to be optional 😁
If someone wants it, they can enable it.

[majkinetor]

Here it is:

• https://github.com/VShawn/PRemoteM/wiki/Security#why-premotem-dont-need-a-activation-password

Also: #429

[bokkoman]

That link seems a bit outdated and not really up to par in modern ages.
The discussion link is interesting. A windows Hello (or master password/pin) would be very beneficial for this app.
Of course only optional, you can turn it on/off within settings.
It will only ask for password/pin on start of the app (after windows boot or app start) and after windows lock. So once your windows session doesn't lock, the app won't ask for a password.

I think adding Windows Hello is actually a viable option and shouldn't be that hard.

[VShawn]

I knew someone would be concerned about the package size. #502

[bokkoman]

Those people probably have 56k modem.
I still haven't found the asset with windows hello.

[VShawn]

just toogle here on the latest package :)

---

And you're right. For some people, accessing the international internet feels like using a 56k modem to browse the web.

[bokkoman]

I am still on a beta asset. Where do I download the package that has the hello function? I can not find it. You linked to some code before, but nowhere does it have a compiled package.

[majkinetor]

Latest nightly

[majkinetor]

That link seems a bit outdated and not really up to par in modern ages.

@bokkoman you need to provide argumentation for your claims, otherwise your stance will get ignored.

Like I said, earlier, physical access to your computer makes any protection you have void because its trivial to circumvent it (unless you use strong encryption). There is even old adage if the bad guy gets physical access, the computer is no longer yours.

What we have currently is password hiding via asterisk which is to prevent shoulder surfing.

Like I already said, major tools dont do this, here is a screenshot from Firefox:

Imagine what happens when I click the eye button. The same is true for Chrome. Its because they know password is useless.

Now, If we imagine this will get done one day, for whatever invalid reason, I would personally not use any kind of solution that doesn't prompt with OS password. It could easily be tested with equivalent of this:

$PlainPassword="your_password"

$tmp = New-TemporaryFile
$SecurePassword = $PlainPassword | ConvertTo-SecureString -AsPlainText -Force
$Credentials = New-Object System.Management.Automation.PSCredential -ArgumentList $Env:USERNAME,$SecurePassword
Start-Process whoami -Credential $Credentials -RedirectStandardOutput $tmp
(Get-Content $tmp -ErroraAction ignore) -like "*\$Env:Username #true if password is OK
Remove-Item $tmp -ErrorAction ignore

Its trivial to do and doesn't require from user to do anything apart from maybe enabling it in config.

However, its invalid, because its trivial to cirmuvent by having access to the computer

1. You can just open the SQLITE database
2. You can use start/end script with echo %PASSWORD% as it is passed as env var
   1. Now you should lock config changes and if script is set, keep script hashsum to prevent external modification
      1. Which is again easy to circumvent as you can just inspect the environment of the started connector

So you have to be extremelly unmovated to not get ones passwords. It could stop little kids and babies though 🍼

Now, what could be done. We could save passwords in Windows Credential Manager instead of the database directly. This is how RDP actually does it nativelly. However, those are easily obtained once you have access to the OS - if you have access to username, its trivial, because you have an eye button again :) If you have another users, there are number of tools that lets you hijack OS.

[bokkoman]

That link seems a bit outdated and not really up to par in modern ages.

@bokkoman you need to provide argumentation for your claims, otherwise your stance will get ignored.

Like I said, earlier, physical access to your computer makes any protection you have void because its trivial to circumvent it (unless you use strong encryption). There is even old adage if the bad guy gets physical access, the computer is no longer yours.

What we have currently is password hiding via asterisk which is to prevent shoulder surfing.

Like I already said, major tools dont do this, here is a screenshot from Firefox:

Imagine what happens when I click the eye button. The same is true for Chrome. Its because they know password is useless.

If you click that, it will ask for your password. If it doesn't, you didn't setup Firefox properly.
That's exactly what I want.

[bokkoman]

This is the functionality I asked for :)

[VShawn]

It could stop little kids and babies though 🍼

But most people are babies when it comes to IT security, so most password management apps are designed with a unlock password.

as bitwarden needs PIN to unlock

[majkinetor]

All cloud password managers do it, however, passwords are not at your computer, but on their servers. That changes the context somewhat (keyloggers still work for example, and those are trivial to setup, but bruteforce and some other techiniques do not).

However, in 1RM case, it still injects %PASSWORD% into environment and it still has salted password in the database itself which are trivial to decode (especially trivial because 1RM is open source, but not mutch harder otherwise, since its .net and decompilers are great). But really, password in environment makes it as easy as it gests, I can only add script that does echo %PASSWORD% and you don't have to be a genious or security non-baby. To prevent this, you must ask for password on saving configuration and changing the content of the script file which is very user unfriendly.

So, the main problem is, by implementing this you are contributing to peoples false security so they may abandon other, better measures, like taking good care of their computer. Its like selling the dors that have well known universal key.

I certainly do not object to this feature, I just think it low priority and not very important :)

BTW, I just checked now, Chrome unlike FF asks for OS password.

[majkinetor]

Actually, there is a phrase from thieving community about dors that is approriate - it prevents regular folks getting into temptation, it does nothing to thiefs :) All of this also applies to our previous discussion about cached databases :)

[VShawn]

All cloud password managers do it, however, passwords are not at your computer

not right. At least Bitwarden and Chrome store their secrets locally, because I can use them offline. Even the secrets in Chrome can be read by third parties. And these tools still acquire PIN the before view secrets.

there is a phrase from thieving community

The phrase in thieving community makes sense, I understand your thoughts, they are idealistic, and personally, I agree with them. But we have various clients, so I still hold my view on the db cache: We need the most basic security measures to protect our passwords from baby thieves (such as simply ensuring that during the 30 seconds you get up to pour coffee, even if you forget to lock your PC, non-professionals cannot directly see/export passwords from 1Remote). You should be known the broken windows theory. A software that can read secrets without any verification is more susceptible to malicious people.

Moreover, as you have seen, so many people want this feature.

P.S. I tend to integrating with Windows password, as requiring the Windows unlock PIN or facial recognition every time you need view password.

[bakerboy448]

Generally every password manager out there that exists offers two major functionalities here and follow basic opsec which is generally what appears to be requested by the community yet rejected by the devs for some unknown reason.

• passwords shall never be stored in plain text and should be hashed and salted
• An option to require some sort of master password or reauth to view/edit passwords should exist

Regarding cloud based managers, not a single one of them store anything in plain text and for anyone to insinuate otherwise means said individual has no clue what they're talking about.

For a pretty solid write-up, see 1Password's white paper

of course given physical access security drops significantly, but it can be made so one effectively has to freeze and get information from RAM or via a keylogger. Which at that point if your system is that compromised, you're screwed anyway. Physical access to the db or software should never reasonably provide direct ease of access without some sort of additional (optional) protection as requested here

in sum
all that is needed is a master password on the db and app with a timeout for the app and optional reprompt to edit. This is standard practice

[VShawn]

Thx for your information:)

we have encrypt and salted storing password, and I'm working on integer Windows hello verification before view password.

[majkinetor]

#466