Pidgin stores passwords in plain text

[Brewster Malevich]

Binary package hint: pidgin

home/<username>/.purple/accounts.xml

This file has unencrypted passphrases for all the accounts used in Pidgin. Isn't this a security risk?

[Magnus S (magnuss)]

Yes, thats a security issue.
http://brainstorm.ubuntu.com/idea/10065/

[Julian Alarcon (julian-alarcon)]

Mentioned again here:
http://www.ubuntu-unleashed.com/2007/08/howto-local-password-encryption-for.html

I check my accounts and I can't belive it.. Plain text, anyone can read this info, take control of, for example.. my Gmail account -> Launchpad -> Google Reader -> University Account -> Microbloggins -> Private Works -> etc..

Please fix this bug, here is one fix for that:
http://www.ubuntu-unleashed.com/2007/08/howto-local-password-encryption-for.html

[Julian Alarcon (julian-alarcon)]

Las idea from brainstorm is a duplicate of:
http://brainstorm.ubuntu.com/idea/4728/

Please take care of this.

[Magnus S (magnuss)]

Thanks for the ping Julián.

Upstream doesn't seem to be interested in fixing this. Read http://developer.pidgin.im/wiki/PlainTextPasswords.
There is also a patch in http://developer.pidgin.im/ticket/5872.

[Hadmut Danisch (hadmut)]

Any progress? Any intention to move to a more secure messenger?

[Jamie Strandboge (jdstrand)]

Upstream has indicated in their bug that they will not fix this. As we will not diverge fro upstream on this point, closing as "Won't Fix".