Login at Kodi Home

Enigma0 · 2015-04-20, 17:07

WebDAV HTTPS and SFTP both store passwords in mediasources.xml and sources.xml in plain text.

This is a pretty big security hole as any other program on the system could read these files.

Other protocols may be equally insecure in terms of storage but I haven't tested them.

~~Ned Scott~~ · 2015-04-20, 21:06

A few more store plaintext passwords in the passwords.xml file as well.

Better security is on the to do list/wish list, but I'm not sure if anyone has started work on it yet. Until then, we should likely give some kind of warning in Kodi about passwords being stored in plain text, IMO.

**Memphiz** · 2015-04-21, 11:19

It will never be secure btw because we are open source and need to provide the used private keys somewhere in the code. This means - if we encrypt the passwords and kodi needs to decrypt them (for authentication with the servers) - anyone can do so aswell by looking up the decryption code in our github repo ...

**Ace** · 2015-04-21, 14:53

We could use Credentials Management (https://msdn.microsoft.com/en-us/library...85%29.aspx) for example.

**takoi** · 2015-04-21, 15:21

(2015-04-21, 11:19)Memphiz Wrote: It will never be secure btw because we are open source and need to provide the used private keys somewhere in the code. This means - if we encrypt the passwords and kodi needs to decrypt them (for authentication with the servers) - anyone can do so aswell by looking up the decryption code in our github repo ...

You don't store the password to the encrypted passwords ofc. but user must re-enter it on startup for instance. Or use existing solutions like that^, kwallet, gnome keyring etc.

Enigma0 · 2015-04-21, 15:42

(2015-04-21, 11:19)Memphiz Wrote: It will never be secure btw because we are open source and need to provide the used private keys somewhere in the code. This means - if we encrypt the passwords and kodi needs to decrypt them (for authentication with the servers) - anyone can do so aswell by looking up the decryption code in our github repo ...

A unique key could be generated per install when the user wants to store a password that would otherwise be unsafe. The code to generate the key would be open source and viewable but not the users keys.

**takoi** · 2015-04-21, 16:05

(2015-04-21, 15:42)Enigma0 Wrote:
(2015-04-21, 11:19)Memphiz Wrote: It will never be secure btw because we are open source and need to provide the used private keys somewhere in the code. This means - if we encrypt the passwords and kodi needs to decrypt them (for authentication with the servers) - anyone can do so aswell by looking up the decryption code in our github repo ...

A unique key could be generated per install when the user wants to store a password that would otherwise be unsafe. The code to generate the key would be open source and viewable but not the users keys.

It doesn't matter if you can generate a key, you still need to store it someplace safe. Also, even if you were closed source, storing the key in the binary blob is barely better than plain text so don't go there :)

Drekko · 2017-09-11, 04:53

Hi
Just discovered this myself with version 16 and was a bit shocked

I updated to version 17.3 but have not set up any remote shares yet

Does anyone know if this is fixed yet?

typoknig · 2018-12-12, 19:30

This is still an issue as of Kodi v18. Kodi is also storing passwords in plain text in the MySQL database if you have a shared library. The only good way I could see around this right now was to create a "kodi" user and Kodi specific shares on my media server to limit access/damage in the event someone accesses my network with malicious intent.

**Memphiz** · 2018-12-12, 20:26

Well there is only one technical solution to have those passwords secured. Users would need to enter a master password for decryption. Anything else would be like saving it plaintext (using a master key for all passwords for that is hardcoded on the code for example).
At least this is the case for all share protocols that don‘t support key authentication. (So protocols were Kodi needs to decrypt the password before using it for authentication)

Or do you have any other solution in mind?

typoknig · 2018-12-13, 05:47

That seems like a good solution, but I was thinking just salting the passwords would be sufficient.

**Memphiz** · 2018-12-13, 08:16

Salting? Without hashing? Well a salted hash is save but for authenticating to samba servers for example we need the plain text password which can‘t be recalculated from the (salted) hash.

typoknig · 2018-12-14, 03:18

When I said "salt" I meant "salt and hash". I see the problem now though. With salt/hash you never have the plain text password stored, so if you want it for SMB you would need to have the user enter it each time which is no good.

Is there anything at the OS level that can be used to keep the passwords more secure? I realize that even if there is for Windows and Linux that might still not be good enough since Kodi supports so many platforms.