1
users.equivalent_domains field is cleartext in the database
Source: dani-garcia/vaultwarden#1400 · opened by @jtackaberry
Subject of the issue users.equivalent_domains is cleartext in the database which could leak information about sites users visit (under the assumption that users will enter domains here that they visit). Your environment • Bitwarden_rs version: 1.19.0 • Install method: Docker image • Clients used: N/A • Reverse proxy and version: N/A • Version of mysql/postgresql: N/A (sqlite backend) Expected behaviour The field should be encrypted and opaque to the admin, or if this data is required to be cleartext for some backend functionality to work, that should be documented somewhere, and ideally there should be a big warning box on the front end where this is configured saying this information shouldn't be considered private. (Though as the web client isn't your code I'm not sure if this is feasible, but it's certainly preferable of possible.) Actual behaviour The field is stored in plaintext and users would incorrectl…
No pledges yet. Be the first to back this.
Comments
Similar requests
Maintenance mode
4 votes · 0 comments
First-class Auth Method abstraction for OAuth/SSO logins (WeChat, Google, etc.)
1 vote · 0 comments
Serverless hosting options
4 votes · 0 comments
[Feature Request] Disable organization administration for users (org admins)
1 vote · 0 comments
database credentials encryption
1 vote · 0 comments
No comments yet.