Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature request] Ask remote network passwords directly from users instead of typing it manually in matrix-puppet-bridge config file #26

Open
MurzNN opened this issue Aug 2, 2017 · 1 comment

Comments

@MurzNN
Copy link

MurzNN commented Aug 2, 2017

At now each matrix puppet bridge store remote network password or token in config.json files (or in same places). On most of companies configuring and starting bridge is admin-man work, not any usual company employee.

So all company employees must give plaintext password of his facebook/skype/hangouts/etc account to admin-man - this is main and very large security hole for them: after this admin will can lookup my facebook private photos???

We can greatly minimize this problem if admin only type account info in bridge server side, and bridge will ask password of remote network directly from user, and store it on server side (in memory, or even on files) without engagement of admin-man.

So users will type passwords on his computer only, without giving them to admin-man.

This will not totally protect password from intercepting via admin on bridge server side, but this is much better and secure process for users that now, when users must give his passwords to admin-man.

At now many public XMPP gateways works like suggested here, and there are no big problem with security.

@ptman
Copy link

ptman commented Aug 21, 2017

I'm thinking this could also help with Two Factor Auth, like with facebook. matrix-hacks/matrix-puppet-facebook#27

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants