Plaintext password in log about docker-icloudpd HOT 5 CLOSED

There's no variable that can be set which would switch it off, unfortunately.

In the first releases of my code I only printed ***** in the logs, but I changed that after I wasted half a day due to an incorrect password.

Printing the plain text in the log file doesn't make a difference as only the root user has access to the container log files location. If the root use wants to see the Apple ID's credentials, a quick docker inspect <whatever the container is named> | grep apple will reveal them. No need to trawl through the logs.

from docker-icloudpd.

Well, I've created a new version that will save the credentials (in plain text) to a file in the /config directory, All it really does is move the problem from the log files directory to the config directory. It dies prevent it being stored in a docker variable though so it can no longer be found through a docker inspect <container name> though, so that's an improvement, of sorts

However, while I have been testing this, I've noticed a far larger security problem. When the script runs the Python command to download the photos, and user can just ps -ef | grep password and they will be able to see the credentials that are passed on the command line. If you're concerned about security, then it's probably best if you avoid using this.

I did look at storing the credentials in the system/Python keyrings quite a while ago but found neither worked and just bombed the application out with an error. I didn't spend much time investigating as I'd got a working solution. I think I should probably revisit it now I know it's leaking credentials.

from docker-icloudpd.

I've implemented keyring stored passwords now and it's working. I just need to test that the old method still works and that switching to keyring stored passwords works OK.

Problem is that my account has been throttled for too many downloads. Hopefully it'll clear in a few hours/days.

from docker-icloudpd.

Fantastic! I will watch for it, appreciate your work.

from docker-icloudpd.

Gives me something to do during the COVID lockdown!

I've just pushed the new version now. You'll have to either omit the apple_password option, or set it to usekeyring

Then launch the container interactively, like you do when you generated the 2FA cookie, and complete the keyring setup process. You'll have to enter a text authentication code from Apple like I did, presumably.

You should then see the password 'usekeyring' in the logs instead of the actual password.

The keyring password file will live in /config/python_keyring/ so it persists across container re-creations. If you check it, the password inside is encrypted.

from docker-icloudpd.