You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Nightscout API Secret in Loop is visible in the unhashed form. Since NS Care Portal is quite powerful (e.g. for users of OpenAPS who set temp targets remotely) it would be nice if the API Secret text field was secure (dots for the characters). Also, the API Secret could be hashed and only the hashed version stored within Loop.
There is a way for NS users to retrieve their hashed API already...we could also change the field to that entry. Although, it would have the downside of making people do something semi-technical (opening up a console view in a browser and finding their hashed API in the settings)
What's the security benefit here? In a browser you can just set the cookie
to the right hashed value and get the same access as if you provide the
cleartext password...
On Wed, Mar 22, 2017 at 2:39 AM, katie disimone ***@***.***> wrote:
There is a way for NS users to retrieve their hashed API already...we
could also change the field to that entry. Although, it would have the
downside of making people do something semi-technical (opening up a console
view in a browser and finding their hashed API in the settings)
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#407 (comment)>, or mute
the thread
<https://github.com/notifications/unsubscribe-auth/AAE2ahVxsIGzA36aSsvJFc03VKpb6bxEks5roHvEgaJpZM4Mdl8g>
.
Activity
Kdisimone commentedon Mar 22, 2017
There is a way for NS users to retrieve their hashed API already...we could also change the field to that entry. Although, it would have the downside of making people do something semi-technical (opening up a console view in a browser and finding their hashed API in the settings)
trixing commentedon Mar 22, 2017
Kdisimone commentedon Oct 18, 2018
I will add a customization instruction to the Loopdocs to let people choose whether their API secret is displayed or not...easy change on this line
Loop/Loop/Models/ServiceAuthentication/NightscoutService.swift
Line 31 in a5bc15a
thebookins commentedon Oct 18, 2018
Thanks Katie!
Kdisimone commentedon Oct 14, 2019
#1142
LOOP-1302: Remove early `dismiss()` that was hiding certain errors fr…