Posts: 1,432
Joined: May 2004
Reputation:
73
BlueCop
Skilled Python Coder
Posts: 1,432
I am working on a plug-in for the videos on amazon.com for prime member subscribers. I have been wary or storing my amazon password in clear text for plug-in settings though. I don't mind much for video sites because there isn't much damage to be done. amazon is a different story though. a lot of potential damage could be done.
I was thinking of just prompting the user for their password whenever their login tokens expired. A authenticated token has risks too though.
anyone have any better ideas?
Posts: 275
Joined: Jul 2010
Reputation:
5
i'd be interested in a solution as well, for premium megaup passwords in icefilms plugin.
Posts: 282
Joined: Feb 2009
Reputation:
0
What sort of attack would you be concerned about? Someone who gets remote access to the machine and is able to just view a single file with plaintext user info? Why not prompt for the user/pass plus a security pin once, encrypt it using cryptopy's AES methods (generate a random key, ex: ((current week of the year * rand number).exponent(pin) + salt)), store the encrypted user info in XBMC's settings and the key in a separate file in the addon_data directory. When the week is up, the key won't match and you'll be prompted to re-enter your username/pass and enter a new pin. That's probably a horrible way to generate a key, by the way, but it's just an example.
I suppose all of the pieces would be there to decrypt the data (key in one location, encrypted user/pass in another, decryption routine in the .py file)... a determined person could still pull out the user/pass, but it would be enough so that someone couldn't connect to your box and open a single text/XML file.
Posts: 1,432
Joined: May 2004
Reputation:
73
BlueCop
Skilled Python Coder
Posts: 1,432
maruchan: I am not super concerned. I just didn't like the idea of having a clear text settings file with a labeled password setting in an amazon addon directory. It just seems to easy to get at.
watzen & maruchan: Thanks for the pin code idea. I think this is a good solution.
My plan right now is too include an option to encrypt your password with a pin code you enter when launching the plug-in. Also an option to disabled pin but still store an encrypted password with constant key to somewhat obfuscate it. Someone will have to be at least motivated enough to look at the code.
The pin code will also be useful in the future to prevent premium purchases from someone using your htpc. I am only working on the free content right now though. It would be pretty cool to be able to rent movies from xbmc though.
anyway I ramble too much. many thanks for the replies
Posts: 1,545
Joined: Oct 2008
Reputation:
31
fekker
Posting Freak
Posts: 1,545
Not sure how it would be implemented, but what about a machine specific guid that's calculated at runtime that's used to encrypt/decrypt the account and password information. That way the password is only usable on the machine it's running on, and not stored in plain text. Similar to the stuff Microsoft uses for windows activation (as far as the hardware it looks at).
