{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/10318","labels_url":"https://api.github.com/repos/docker/docker/issues/10318/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/10318/comments","events_url":"https://api.github.com/repos/docker/docker/issues/10318/events","html_url":"https://github.com/docker/docker/issues/10318","id":55340082,"number":10318,"title":"dockercfg insecure","user":{"login":"rafaelhbarros","id":3138550,"avatar_url":"https://avatars.githubusercontent.com/u/3138550?v=3","gravatar_id":"","url":"https://api.github.com/users/rafaelhbarros","html_url":"https://github.com/rafaelhbarros","followers_url":"https://api.github.com/users/rafaelhbarros/followers","following_url":"https://api.github.com/users/rafaelhbarros/following{/other_user}","gists_url":"https://api.github.com/users/rafaelhbarros/gists{/gist_id}","starred_url":"https://api.github.com/users/rafaelhbarros/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rafaelhbarros/subscriptions","organizations_url":"https://api.github.com/users/rafaelhbarros/orgs","repos_url":"https://api.github.com/users/rafaelhbarros/repos","events_url":"https://api.github.com/users/rafaelhbarros/events{/privacy}","received_events_url":"https://api.github.com/users/rafaelhbarros/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/Distribution","name":"Distribution","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":32,"created_at":"2015-01-23T22:14:51Z","updated_at":"2015-01-26T23:14:32Z","closed_at":null,"body":"After a docker login, the CLI stores the password encoded in base64 in a file called dockercfg, and that is not entirely secure. I'd like to suggest changing that to keep either a token returned from the index, or another security mechanism to be implemented instead of saving passwords in plaintext.\r\n\r\nThis is particularly unsafe in case of open/shared workstations or in case the authentication happens against a custom index with higher security concerns about the password."},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/71558986","html_url":"https://github.com/docker/docker/issues/10318#issuecomment-71558986","issue_url":"https://api.github.com/repos/docker/docker/issues/10318","id":71558986,"user":{"login":"mgk","id":465265,"avatar_url":"https://avatars.githubusercontent.com/u/465265?v=3","gravatar_id":"","url":"https://api.github.com/users/mgk","html_url":"https://github.com/mgk","followers_url":"https://api.github.com/users/mgk/followers","following_url":"https://api.github.com/users/mgk/following{/other_user}","gists_url":"https://api.github.com/users/mgk/gists{/gist_id}","starred_url":"https://api.github.com/users/mgk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgk/subscriptions","organizations_url":"https://api.github.com/users/mgk/orgs","repos_url":"https://api.github.com/users/mgk/repos","events_url":"https://api.github.com/users/mgk/events{/privacy}","received_events_url":"https://api.github.com/users/mgk/received_events","type":"User","site_admin":false},"created_at":"2015-01-26T23:14:32Z","updated_at":"2015-01-26T23:14:32Z","body":"Glad to see this is being taken seriously. The planned use of JWTs and SSH key pairs looks great.\r\n\r\n>we should aim for the right solution - not just \"any solution as fast as possible\" - this will take time and energy, but I'm confident we will get there\r\n\r\nMakes good sense. In the meantime making sure users are aware of the risk is important. As a user I'm happy wait for the right solution and take steps to mitigate security weaknesses, but I need to know what they are to do that.\r\n\r\nI second [the suggestion by @thaJeztah](https://github.com/docker/docker/issues/10318#issuecomment-71340996): `docker login` v1 should inform the user that it is saving their unencrypted creds to `~/.dockercfg`.\r\n"}}