{"action":"created","issue":{"url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/348","labels_url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/348/labels{/name}","comments_url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/348/comments","events_url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/348/events","html_url":"https://github.com/shadowsocks/shadowsocks/issues/348","id":88044429,"number":348,"title":"Please don't store password in plaintext","user":{"login":"zypA13510","id":8077540,"avatar_url":"https://avatars.githubusercontent.com/u/8077540?v=3","gravatar_id":"","url":"https://api.github.com/users/zypA13510","html_url":"https://github.com/zypA13510","followers_url":"https://api.github.com/users/zypA13510/followers","following_url":"https://api.github.com/users/zypA13510/following{/other_user}","gists_url":"https://api.github.com/users/zypA13510/gists{/gist_id}","starred_url":"https://api.github.com/users/zypA13510/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zypA13510/subscriptions","organizations_url":"https://api.github.com/users/zypA13510/orgs","repos_url":"https://api.github.com/users/zypA13510/repos","events_url":"https://api.github.com/users/zypA13510/events{/privacy}","received_events_url":"https://api.github.com/users/zypA13510/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-13T18:25:43Z","updated_at":"2015-06-14T00:50:03Z","closed_at":"2015-06-13T18:35:20Z","body":"一个与安全性无关的安全性问题：\r\n现有的ss版本，为何用户的密码直接使用明文？虽然这段明文不会被直接发送只是作为加密的key（至少以我的理解是这样），但是直接导致存储时用户的密码也必须明文存储（客户端与服务端均是如此）。从软件设计的角度考虑这样的设计是否欠妥？\r\n我的建议是：使用hash(password)作为加密的key，服务端与客户端的配置文件均只存储该哈希值，协议层仍然是不变的，只是加密所用的key多了一层哈希。\r\n\r\nA security related issue without actual concerns about security:\r\nIn the current shadowsocks, password used as encryption key are stored in plaintext (both client and server), though this password is not sent directly in transmission. I don't think this complies with security standard. I would recommend using the hash of password as an encryption key, e.g. md5(password). And instead of storing the password in plaintext, store the hash in config. This way we prevent any would-be attackers from getting the password plaintext. (And service provider no longer require user password in plaintext, only the hash need to be stored on server)"},"comment":{"url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/comments/111766101","html_url":"https://github.com/shadowsocks/shadowsocks/issues/348#issuecomment-111766101","issue_url":"https://api.github.com/repos/shadowsocks/shadowsocks/issues/348","id":111766101,"user":{"login":"PeterCxy","id":4532423,"avatar_url":"https://avatars.githubusercontent.com/u/4532423?v=3","gravatar_id":"","url":"https://api.github.com/users/PeterCxy","html_url":"https://github.com/PeterCxy","followers_url":"https://api.github.com/users/PeterCxy/followers","following_url":"https://api.github.com/users/PeterCxy/following{/other_user}","gists_url":"https://api.github.com/users/PeterCxy/gists{/gist_id}","starred_url":"https://api.github.com/users/PeterCxy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PeterCxy/subscriptions","organizations_url":"https://api.github.com/users/PeterCxy/orgs","repos_url":"https://api.github.com/users/PeterCxy/repos","events_url":"https://api.github.com/users/PeterCxy/events{/privacy}","received_events_url":"https://api.github.com/users/PeterCxy/received_events","type":"User","site_admin":false},"created_at":"2015-06-14T00:50:03Z","updated_at":"2015-06-14T00:50:03Z","body":"既然都是存储在本地，最终都要解密，又不可能再做一层加密，那么hash不hash其实没有任何区别，莫非你还要对密码再做一层AES什么的加密吗？只要控制好权限，没有任何不妥之处。\n\n再者按照issue主的思路，hash存储在本地以后客户端可以直接使用，那么请问，这个hash跟明文有什么区别？得到了hash跟得到了明文是一个效果。\n\n\n\nSent using CloudMagic [https://cloudmagic.com/k/d/mailapp?ct=pa&cv=6.3.35&pv=5.1.1]\n\nOn Sun, Jun 14, 2015 at 8:02 AM, zypA13510 < notifications@github.com [notifications@github.com] > wrote:\n一个与安全性无关的安全性问题：\n\n现有的ss版本，为何用户的密码直接使用明文？虽然这段明文不会被直接发送只是作为加密的key（至少以我的理解是这样），但是直接导致存储时用户的密码也必须明文存储（客户端与服务端均是如此）。从软件设计的角度考虑这样的设计是否欠妥？\n我的建议是：使用hash(password)作为加密的key，服务端与客户端的配置文件均只存储该哈希值，协议层仍然是不变的，只是加密所用的key多了一层哈希。\n\nA security related issue without actual concerns about security:\nIn the current shadowsocks, password used for encryption key are stored in\nplaintext (both client and server), though this password is not sent directly in\ntransmission. I don't think this complies with security standard. I would\nrecommend using the hash of password as an encryption key, e.g. md5(password).\nAnd instead of storing the password in plaintext, store the hash in config. This\nway we prevent any would-be attackers from getting the password plaintext. (And\nservice provider no longer require user password in plaintext, only the hash\nneed to be stored on server)\n\n—\nReply to this email directly or view it on GitHub [https://github.com/shadowsocks/shadowsocks/issues/348] .[https://github.com/notifications/beacon/AEUox2PrwPsUaGF9R4mQBiTHiUmlPWCkks5oTG09gaJpZM4FCGn-.gif]"}}