Prevent exposing password at all about android-singlesignon HOT 12 CLOSED

Yeah something like that should work

from android-singlesignon.

To harden this further, we should also verify the calling package, so that both must match: calling package name and secret token

from android-singlesignon.

Also as a reminder to myself. We should extend the server scope. so that if you request a new token for appX. That token can no longer request new tokens.

from android-singlesignon.

@David-Development this then would mean that we also can avoid to provide server url and password to the 3rd party app, or?

from android-singlesignon.

I think even in the current setup it should be possible to remove that information. We just need an identifier for the account. However clients usually want to display that kind of information (as seen in my news app (e.g. https://lh3.googleusercontent.com/MD8OGFI6O_pbbbUz3_hFfXtaadQhhWpvBW_pftGKCSEMn48u4Di5ti0c3JCLp2tFhXM=w3360-h1952-rw)

However the password can be replaced with a token. (as already mentioned in the source code: https://github.com/nextcloud/android/blob/be3d90427cbccf16fae72dff1f238cd8223b0850/src/main/java/com/owncloud/android/authentication/AccountAuthenticator.java#L183)

from android-singlesignon.

Right, passing the server url should still be done, for UX 👍
But I would like to remove the password entirely, so that even the freshly generated token is not transferred within android and thus is never exposed.

I will give it a try.

from android-singlesignon.

Password is indeed not needed, so I will create a PR for this on Monday, based on #8, so that #8 is not cluttered up too much.

from android-singlesignon.

I would also include calling package as further security step, so that both must match: calling package and token.

from android-singlesignon.

I have added calling package, but for now we are using the same token as the original login.

from android-singlesignon.

@rullzer we can then use the passed calling package name to name the auth token, once this is ready.

from android-singlesignon.

@tobiasKaminsky I think this is already implemented by now, isn't it? (See https://github.com/nextcloud/android/blob/sso/src/main/java/com/owncloud/android/authentication/AccountAuthenticator.java#L182)

from android-singlesignon.

@David-Development yes, this is implemented 👍

from android-singlesignon.