wallabagger
wallabagger copied to clipboard
Username and Password shouldn't be required
wallabagger should not require username/password to login, only client id and secret.
This is a known problem with wallabag itself and the following issue needs to be resolved before wallabagger can be adopted to login without user/pw: https://github.com/wallabag/wallabag/issues/2800
To be noted that Username and password are stored clear text in storage.js which is a critical security issue to me, corresponding issue : #151.
The sources of extension can be obtained freely, so any ways of credentian obfuscation are quite useless. Without resolvind the serverside issue #2800 there is nothing to do.
Linked to https://github.com/wallabag/wallabagger/issues/151#issuecomment-440984976
I was coming here to ask about this as well.
The API client should be able to do whatever it needs, the user login information should really be for the user.
Same here it(s being a long time I'm wondering, if API KEY / SECRET are created in the web app and then copy/pasted in FF addons and Android App, Why but why I also have to enter my login and password.
Works for me by only providing a correct username and garbage password, in addition to the Client ID + Secret.
It still stores more information than should be required but at least not the password.