Hacker News Reader

Comment by songgao | Hacker News Reader

Looks like the Google API client ID and client secret are stored in clear text shipped with the released app:

  WMail.app/Contents/Resources/app/bin/shared/credentials.js

, and this seems to be used in authentication with Google: https://github.com/Thomas101/wmail/blob/master/src/main/Auth...

View on HN

I think "secret" is a misnomer here.

The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)

https://developers.google.com/identity/protocols/OAuth2 (under "Installed Applications")

Interesting. Thanks for the link! I wonder why they still require a client_secret in installed application?

There's not really anything you can do about this unless you want Wmail to have to stand up a server to authenticate with, at which point you're no really getting any additional security because Wmail still needs to store some sort of credential on your machine for persistent login that an attacker could steal to authenticate with Wmail on their own machine.

An attacker would have to steal your access token stored locally on your machine to use with this public client id and client secret, and if you have software that's maliciously scraping credentials from your machine you already have a problem.

There's still a reason why e.g. the OSX Keychain, SSH private keys, etc. are stored encrypted-at-rest. I like the fact that I can create a cleartext backup of my hard disk and throw it in the trash, and the person who finds it won't be able to get my passwords off of it.

Reply on news.ycombinator.com