View Issue Details

IDProjectCategoryView StatusLast Update
0009165Talermerchant-pos-terminal (Android App)public2024-09-14 01:08
Reportermikolai Assigned Toavalos  
PriorityhighSeverityfeatureReproducibilityN/A
Status resolvedResolutionreopened 
Target Version0.14Fixed in Version0.14 
Summary0009165: Do not show password in the settings screen (only on password change)
DescriptionAnyone with access to a configured POS terminal can currently easily obtain the password (secret-token) of the merchant backend instance. With that information, they can login to the merchant SPA and do harmful things, e.g., change the connected bank account.

An easy fix would be to not allow to reveal the current password by either disabling the toggle or showing (current) or something similar instead.

We would need that functionality for the Datenspuren event, and wouldn't mind having it on a separate branch if the current behavior should stay on master. I wouldn't see proper reasons for that, though.
TagsNo tags attached.

Activities

avalos

2024-09-05 20:47

developer   ~0023188

In my opinion, access to the PoS (or any authenticated device, for that matter) should always be supervised. The ideal fix here would be for the merchant backend to provide multiple tokens with different levels of access for a single instance, effectively making it possible to restrict a PoS token from modifying the bank account or doing any modifications in the inventory.

However, if what you are planning is to leave your terminals unsupervised at the event, I can implement the toggle, sure.

avalos

2024-09-05 21:37

developer   ~0023191

Enjoy!

commit 0310be19806ee821261947afb90e40fe14e1aa70 (HEAD -> master, origin/master)
Author: Iván Ávalos <avalos@disroot.org>
Date: Thu Sep 5 21:36:50 2024 +0200

    [pos] "Remember password" now empties password field when unchecked

mikolai

2024-09-06 07:15

developer   ~0023199

Thanks for the fix, just tried it out with the nightly and it works, but with the following caveat:

If the app is closed, the configuration is forgotten and you have to re-type the password (obviously, because I told it to forget the password). Wouldn't it have been possible to make this independent of the "remember password" option and save the password if requested, but just don't show it back to the user when opening the settings screen? basically disabling the "show password" toggle in that case.

avalos

2024-09-06 08:33

developer   ~0023202

It is not trivial to do, as the system provided TextField doesn't expose this functionality of hiding the visibility toggle.

avalos

2024-09-13 11:54

developer   ~0023283

Fixed in version 0.2.7, now the password hides even when “Save password” is checked, the only difference when the toggle is unchecked is that the session won't be restored in the next launch and the user will need to type it again. I hope that this satisfies the Datenspuren requirements.

Issue History

Date Modified Username Field Change
2024-09-03 16:30 mikolai New Issue
2024-09-03 16:30 mikolai Status new => assigned
2024-09-03 16:30 mikolai Assigned To => avalos
2024-09-05 20:47 avalos Note Added: 0023188
2024-09-05 21:37 avalos Status assigned => resolved
2024-09-05 21:37 avalos Resolution open => fixed
2024-09-05 21:37 avalos Note Added: 0023191
2024-09-06 07:15 mikolai Status resolved => feedback
2024-09-06 07:15 mikolai Resolution fixed => reopened
2024-09-06 07:15 mikolai Note Added: 0023199
2024-09-06 08:33 avalos Note Added: 0023202
2024-09-09 09:10 Christian Grothoff Status feedback => assigned
2024-09-09 09:56 Christian Grothoff Target Version => 0.14
2024-09-13 11:54 avalos Status assigned => resolved
2024-09-13 11:54 avalos Note Added: 0023283
2024-09-14 01:08 Christian Grothoff Fixed in Version => 0.14