FeatureFuel
1

users.equivalent_domains field is cleartext in the database

Source: dani-garcia/vaultwarden#1400 · opened by @jtackaberry
Subject of the issue users.equivalent_domains is cleartext in the database which could leak information about sites users visit (under the assumption that users will enter domains here that they visit). Your environment • Bitwarden_rs version: 1.19.0 • Install method: Docker image • Clients used: N/A • Reverse proxy and version: N/A • Version of mysql/postgresql: N/A (sqlite backend) Expected behaviour The field should be encrypted and opaque to the admin, or if this data is required to be cleartext for some backend functionality to work, that should be documented somewhere, and ideally there should be a big warning box on the front end where this is configured saying this information shouldn't be considered private. (Though as the web client isn't your code I'm not sure if this is feasible, but it's certainly preferable of possible.) Actual behaviour The field is stored in plaintext and users would incorrectl…

No pledges yet. Be the first to back this.

Make a pledge

Pledge your monetary support if this feature is added.

$

Comments

No comments yet.

Replying to

Add a comment

What do you think about this feature request?


Similar requests