Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encrypt mongodb key #1463

Closed
3 of 8 tasks
VakarisZ opened this issue Sep 14, 2021 · 0 comments · Fixed by #1506
Closed
3 of 8 tasks

Encrypt mongodb key #1463

VakarisZ opened this issue Sep 14, 2021 · 0 comments · Fixed by #1506
Labels
Complexity: Medium Feature Issue that describes a new feature to be implemented. Impact: High Security sp/5

Comments

@VakarisZ
Copy link
Contributor

VakarisZ commented Sep 14, 2021

Is your feature request related to a problem? Please describe.
We hold mongodb key on the same machine as the island, so if anyone can access the island and steal the database, they can steal the key as well and decrypt everything

Describe the solution you'd like
Encrypt mongodb key on registration. On start/login decrypt the key and use it from memory

Describe alternatives you've considered
Please describe alternative solutions or features you have considered.

Tasks

  • Delay mongo initialization after registration (0d) - @shreyamalviya @VakarisZ
    • Clear database on registration
    • Update documentation with a note that says if you reset your password the database will be cleared.
  • Refactor Encryptor (0.25d) - @shreyamalviya @VakarisZ
    • Create encrypted mongo key on registration.
    • Decrypt mongo key on login
  • Manual with AppImage, Docker, and MSI (0.5d)
    • Make sure to test reset password proceedure
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Complexity: Medium Feature Issue that describes a new feature to be implemented. Impact: High Security sp/5
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants