Recommendation: Warn against very secure passphrases

chmac · June 15, 2018, 2:38pm

I’ve been experimenting with duplicati recently, after being kicked in the teeth by CrashPlan. I set a very strong password. Lots of symbols. It’s an absolute nightmare to try and use the CLI. Trying to enter the passphrase on the command line has so far proved impossible. I eventually managed to get all the escaping right for an echo of the passphrase, but I get an error when trying to run cli commands. I’d guess there’s another level of escaping I need.

If I’d known this upfront, I’d have stuck to an alphanumeric password and just made it longer. Five or ten extra alphanumerics would provide an equally secure passphrase, but it would be much easier to work with the CLI.

Could we surface this info in the UI somewhere? Perhaps warning people during backup configuration that passwords which are terminal friendly might be easier in the long run.

kenkendk · June 15, 2018, 8:31pm

That hits somewhere between adding security or being user friendly… I am not sure what I like better…

If you have trouble with the shell, you can use the --parameter-file option such that the data is read from a file instead of the commandline.

But we can consider adding an extra label to the UI:

github.com

duplicati/duplicati/blob/master/Duplicati/Server/webroot/ngax/templates/addoredit.html#L53


    <label for="encryption" translate>Encryption</label>
    <select name="encryption" id="encryption" ng-model="Options['encryption-module']" ng-options="module.Key as module.DisplayName for module in SystemInfo.EncryptionModules">
        <option value="" translate>No encryption</option>
    </select>
</div>


<div class="input encryptionhint" ng-show="(Options['encryption-module'] || '').length == 0">
    <h3 class="warning" translate>We recommend that you encrypt all backups stored outside your system</h3>
</div>


<div class="input password" ng-hide="(Options['encryption-module'] || '').length == 0">
    <label for="passphrase" translate>Passphrase</label>
    <input type="{{ShowPassphrase ? 'text' : 'password'}}" name="passphrase" id="passphrase" ng-model="Options['passphrase']" />
</div>
<div class="input password" ng-hide="(Options['encryption-module'] || '').length == 0">
    <label for="repeat-passphrase" translate>Repeat Passphrase</label>
    <input type="{{ShowPassphrase ? 'text' : 'password'}}" name="repeat-passphrase" id="repeat-passphrase" ng-model="RepeatPasshrase"/>


    <div class="tools">
        <ul>
            <li>

Recommendation: Warn against *very* secure passphrases

Recommendation: Warn against very secure passphrases