Clear text password stored in Duplicati-server.sqlite

[kenkendk]

@sylerner

Not on Linux. But I think I read - but I’m not sure - that there is a password on Windows.

True. The RC4 scrambling feature is only available in the Windows version.

@saviodsouza

Is there a default password

Yes, the default password is Duplicati_Key_42:

duplicati/duplicati/blob/master/Duplicati/Server/Program.cs#L517

@drakar2007

In the mean time, wouldn’t at least doing fake encryption (i.e. duplicati-internal obfuscation) on the password be a better short-term solution than storing it in plaintext? This would at least guard it from accidental discovery etc, and would require specific and targeted knowledge to take advantage of.

Yes, that was the idea with the RC4 encryption. It is not strong, and has a known password, but at least you cannot do string scanning on the harddisk to find the contents.

I am not aware of any plug-n-play solutions for Linux, so we would need to identify all the ways and places a password can be stored, and then handle each field with manual obfuscation/de-obfuscation.

Since the same work is required for the keychain integration, I think it would make sense to have a “fallback keychain”, that is an internal Duplicati keychain with a known password (similar to how the RC4 stuff works on Windows). We can implement this first, and then it should be easier to “plug-in” the real keychain implementations later.