Posts: 42
Joined: Feb 2015
Reputation:
2
WebDAV HTTPS and SFTP both store passwords in mediasources.xml and sources.xml in plain text.
This is a pretty big security hole as any other program on the system could read these files.
Other protocols may be equally insecure in terms of storage but I haven't tested them.
Posts: 31,445
Joined: Jan 2011
A few more store plaintext passwords in the passwords.xml file as well.
Better security is on the to do list/wish list, but I'm not sure if anyone has started work on it yet. Until then, we should likely give some kind of warning in Kodi about passwords being stored in plain text, IMO.
Posts: 16,946
Joined: Feb 2011
Reputation:
256
It will never be secure btw because we are open source and need to provide the used private keys somewhere in the code. This means - if we encrypt the passwords and kodi needs to decrypt them (for authentication with the servers) - anyone can do so aswell by looking up the decryption code in our github repo ...
AppleTV4/iPhone/iPod/iPad: HowTo find debug logs and everything else which the devs like so much:
click here
HowTo setup NFS for Kodi:
NFS (wiki)
HowTo configure avahi (zeroconf):
Avahi_Zeroconf (wiki)
READ THE IOS FAQ!:
iOS FAQ (wiki)
Posts: 19
Joined: Jun 2015
Reputation:
0
Drekko
Junior Member
Posts: 19
Hi
Just discovered this myself with version 16 and was a bit shocked
I updated to version 17.3 but have not set up any remote shares yet
Does anyone know if this is fixed yet?
Posts: 33
Joined: Dec 2012
Reputation:
0
This is still an issue as of Kodi v18. Kodi is also storing passwords in plain text in the MySQL database if you have a shared library. The only good way I could see around this right now was to create a "kodi" user and Kodi specific shares on my media server to limit access/damage in the event someone accesses my network with malicious intent.
Posts: 16,946
Joined: Feb 2011
Reputation:
256
Well there is only one technical solution to have those passwords secured. Users would need to enter a master password for decryption. Anything else would be like saving it plaintext (using a master key for all passwords for that is hardcoded on the code for example).
At least this is the case for all share protocols that don‘t support key authentication. (So protocols were Kodi needs to decrypt the password before using it for authentication)
Or do you have any other solution in mind?
AppleTV4/iPhone/iPod/iPad: HowTo find debug logs and everything else which the devs like so much:
click here
HowTo setup NFS for Kodi:
NFS (wiki)
HowTo configure avahi (zeroconf):
Avahi_Zeroconf (wiki)
READ THE IOS FAQ!:
iOS FAQ (wiki)
Posts: 33
Joined: Dec 2012
Reputation:
0
That seems like a good solution, but I was thinking just salting the passwords would be sufficient.
Posts: 16,946
Joined: Feb 2011
Reputation:
256
Salting? Without hashing? Well a salted hash is save but for authenticating to samba servers for example we need the plain text password which can‘t be recalculated from the (salted) hash.
AppleTV4/iPhone/iPod/iPad: HowTo find debug logs and everything else which the devs like so much:
click here
HowTo setup NFS for Kodi:
NFS (wiki)
HowTo configure avahi (zeroconf):
Avahi_Zeroconf (wiki)
READ THE IOS FAQ!:
iOS FAQ (wiki)
Posts: 33
Joined: Dec 2012
Reputation:
0
When I said "salt" I meant "salt and hash". I see the problem now though. With salt/hash you never have the plain text password stored, so if you want it for SMB you would need to have the user enter it each time which is no good.
Is there anything at the OS level that can be used to keep the passwords more secure? I realize that even if there is for Windows and Linux that might still not be good enough since Kodi supports so many platforms.