{"action":"created","issue":{"url":"https://api.github.com/repos/ShareX/ShareX/issues/482","labels_url":"https://api.github.com/repos/ShareX/ShareX/issues/482/labels{/name}","comments_url":"https://api.github.com/repos/ShareX/ShareX/issues/482/comments","events_url":"https://api.github.com/repos/ShareX/ShareX/issues/482/events","html_url":"https://github.com/ShareX/ShareX/issues/482","id":55114973,"number":482,"title":"FTP password is stored in cleartext in UploadersConfig.json (no warning)","user":{"login":"flarn2006","id":687313,"avatar_url":"https://avatars.githubusercontent.com/u/687313?v=3","gravatar_id":"","url":"https://api.github.com/users/flarn2006","html_url":"https://github.com/flarn2006","followers_url":"https://api.github.com/users/flarn2006/followers","following_url":"https://api.github.com/users/flarn2006/following{/other_user}","gists_url":"https://api.github.com/users/flarn2006/gists{/gist_id}","starred_url":"https://api.github.com/users/flarn2006/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flarn2006/subscriptions","organizations_url":"https://api.github.com/users/flarn2006/orgs","repos_url":"https://api.github.com/users/flarn2006/repos","events_url":"https://api.github.com/users/flarn2006/events{/privacy}","received_events_url":"https://api.github.com/users/flarn2006/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-22T05:06:14Z","updated_at":"2015-01-22T22:19:13Z","closed_at":"2015-01-22T22:19:13Z","body":"When you configure an FTP server and set a password, said password is stored in the Documents\\ShareX\\UploadersConfig.json file in cleartext. Storing passwords in cleartext is generally considered bad practice. However, as it needs to be able to authenticate to the server, it obviously can't be encrypted in any way where the program can't get it back.\r\n\r\nEncoding it just for the sake of not having it in cleartext would more provide a false sense of security than a real solution, so I think the best solution here would be to add some text to the bottom of the configuration dialog saying something to the effect of \"Warning: if you specify a password, it will be stored in cleartext in a configuration file.\"\r\n\r\nMaking the problem worse is the fact that it doesn't seem to work if you don't specify a password--my expectation was that if I removed the password it would simply prompt me for one each time, which is not the case. In fact, the error given is not very helpful--upon clicking the \"Test\" button it literally displays a message box with only a \"(i)\" icon and an OK button (no text), and trying to upload a file gives a misleading \"URL is empty\" error message."},"comment":{"url":"https://api.github.com/repos/ShareX/ShareX/issues/comments/71110904","html_url":"https://github.com/ShareX/ShareX/issues/482#issuecomment-71110904","issue_url":"https://api.github.com/repos/ShareX/ShareX/issues/482","id":71110904,"user":{"login":"Jaex","id":822090,"avatar_url":"https://avatars.githubusercontent.com/u/822090?v=3","gravatar_id":"","url":"https://api.github.com/users/Jaex","html_url":"https://github.com/Jaex","followers_url":"https://api.github.com/users/Jaex/followers","following_url":"https://api.github.com/users/Jaex/following{/other_user}","gists_url":"https://api.github.com/users/Jaex/gists{/gist_id}","starred_url":"https://api.github.com/users/Jaex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Jaex/subscriptions","organizations_url":"https://api.github.com/users/Jaex/orgs","repos_url":"https://api.github.com/users/Jaex/repos","events_url":"https://api.github.com/users/Jaex/events{/privacy}","received_events_url":"https://api.github.com/users/Jaex/received_events","type":"User","site_admin":false},"created_at":"2015-01-22T22:19:13Z","updated_at":"2015-01-22T22:19:13Z","body":"If I encrypt your passwords in json file then people can think their passwords safe and share their json file when people can check encryption key from ShareX assembly. So it will only mislead people of false security. There is no other way to solve this. And warning is very unnecessary ofc it should be stored somewhere otherwise how it can remember. Not understood your other question about prompting each time."}}