-
Notifications
You must be signed in to change notification settings - Fork 102
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[feature request] Abillity to skip master password #309
Comments
Master password skipping request gets rejected since all the sensitive app settings and data if the local store option enabled need to be stored encrypted (see the Master password saving option is added for those who prefer the convenience of storing the master password in the system's keychain which makes the fully automated login into the app and email accounts possible (done using keytar native module). I'd recommend exploring the app capabilities on your own since I believe then many of your questions will be taken off the agenda. You might also want to explore the persistent session feature. |
You can encrypt them with a random key and store it in system keychain (I think most of desktop apps are doing so). My proposal is to encrypt user's data with a random key by default and add setting a master password as an option in settings. compulsory password + "keep me singed in" checkbox is just not used when it comes to desktop apps, ElectronMail should follow this convention in order to be more friendly to non-technical users |
This would make the app less secure by default since currently the master password/key by default is not saved anywhere and enabling saving behavior requires the option to be explicitly activated by the user. I understand why Firefox and alike programs follow the way you described but for this project I prefer it to act like it's done now. Besides that, there are scenarios when the app won't be able to save anything in the system's keychain since there is no keychain provider installed on the system. See #57 (comment) for details if interested.
I'm going to make the master password setup form more informative to let non-technical users become more technical. |
Pushed to master warning message:
|
First thing what you see after installation of ElectronMail is a prompt to set a master password. Why you even need one?
Why not just store the secrets in OS services (or add an option to)?
What you mean by saying "Saving the master password on computer weakens the security."? Most desktop programs actually don't log you out after a restart (including privacy/security ones, like signal-desktop) and don't require any additional password, so why ElectronMail shows a red warning, such as it could lead to a security disaster?
Does saving the master password actually increase my security, when I'm using full disk encryption (BitLocker)?
The text was updated successfully, but these errors were encountered: