don't store plain text passwords in mixxx.cfg

[Daniel Schürmann]

What will be the best encryption method, that works with open source software?

[Daniel Schürmann (daschuer)]

Encrypting the password with a key stored in code, is anti-pattern since it pretends security.

One option is to store the password in an extra file which can be secured by the OSs access levels.

The best option would be to use the OSs Password store facilities.

This projects provides a promising platform-independent wrapper for Qt:
https://github.com/frankosterfeld/qtkeychain

[Daniel Schürmann (daschuer)]

http://packages.ubuntu.com/source/xenial/qtkeychain

[Daniel Schürmann (daschuer)]

This feature is currently disabled.
Should we enable it for 2.1 or is it too risky in this late state?

[Stéphane L. (palakis)]

QtKeychain supports the three OSes supported officially by Mixxx, so it should work out of the box.
However:
- We need to conduct tests on the three main platforms to make sure it works and isn't confusing to use
- It should be best to have a settings options to turn this on/off, with the option disabled by default in the beginning.

[RJ Skerry-Ryan (rryan)]

I think this is going in 2.3, right?

[Daniel Schürmann (daschuer)]

Right.

[RJ Skerry-Ryan (rryan)]

Is there anything left to do for this?

[Daniel Schürmann (daschuer)]

Yes, we need "just" enable it for our binary distributions. It is not enabled in our nighty PPA at least.

[Be (be.ing)]

This is marked In Progress but there is no link to a pull request implementing this. What is the state of this?

[Daniel Schürmann (daschuer)]

The code is already part of 2.1.0. We need to verify that it is enabled in all our binary distributions.

[Daniel Schürmann (daschuer)]

https://github.com/mixxxdj/mixxx/pull/2854

[Swiftb0y (swiftb0y)]

Mixxx now uses GitHub for bug tracking. This bug has been migrated to:
https://github.com/mixxxdj/mixxx/issues/8694