SECURITY: email credentials (address and password) available and stored in plain text

[Edward CT]

I use Xubuntu Trusty 14.04 LTS with the xfce4-mailwatch-plugin 1.2.0.

During maintainance, I noticed that ALL the credentials of all mailboxes to "watch" are stored non-encrypted, in plain text, for everybody to read, copy, and alter in file /home/<username>/.config/xfce4/panel/mailwatch-XX.rc.

The contents of this file looks like this:

[mailwatch-plugin]
click_command=
new_messages_command=
normal_icon=xfce-nomail
new_mail_icon=xfce-newmail
log_lines=500
show_log_status=true
auto_open_online_doc=false

[mailwatch]
nmailboxes=2
mailbox0=imap
mailbox_name0=John Joe
mailbox1=imap
mailbox_name1=Bill Gates

[mailbox0]
host=imap.apple.com
<email address hidden>
password=THISisMYpasswordTOmyINSIDEappleACCOUNT!
auth_type=1
server_directory=
use_standard_port=0
nonstandard_port=0
timeout=480
n_newmail_boxes=1
newmail_box_0=INBOX
[...]

This means that everybody that can easily retrieve ALL the email credentials of an user of xfce4-mailwatch-plugin and reap havoc with it.

I've seen discussions here about SSL and so forth, but...
Shouldn't the info in the /home/<username>/.config/xfce4/panel/mailwatch-XX.rc file be encrypted by default?
IMHO as it is now is frankly similar to taking a yellow Post-It, writing ones email address and password on it, and sticking it on the monitor of your box...

[Seth Arnold (seth-arnold)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

I wouldn't be surprised if upstream decides this isn't a security flaw: they need access to the plaintext password to do their task. If it were encrypted, it would need to be encrypted with a passphrase that would require prompting the user. At that point you may as well just prompt the user for their mail server passwords directly. They could also use the keychain but I believe those are also available unencrypted for all processes to use when they are unlocked, so the keychain may actually be less secure than just putting the passwords into a mode 0600 file.

If the permissions on the file and all containing directories are too permissive, that might be a reasonable security issue, and one that's easy enough to address.

Thanks

[Jens-l+xfce (jens-l+xfce)]

I'm aware of WONTFIX on #3014 and #3516. The link to the rationale does not work any more. You could store passwords in GNOME keyring, which is probably different from "obfuscation" mentioned in the above bugs.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.