SSL Modules Enom Password

[vincent_g]

I have just noticed that WHMCS inserts your Enom user name and password in the products table when you choose an Enom module for the product.

 

Now it would be fine if the password was encripted but it's not.

The password is in plain text.

 

It's not a biggie but it shouldn't be not encrypted.

 

I don't know if other Modules picked do the same thing which maybe a bigger problem.

Enom has two steps of security which requires users to also answer saved questions should the PC not match the stored info. Others may not have this.

 

To see this and if you are using this feature go to your products table in phpmyadmin

Use SQL to sellect only rows from the Group so as to filter out all others.

 

And you will see your Enom password clear as day.

Now I created the product with the latest prior version and have not tested it with the new version but I expect it to be same

 

Vincent G.

[Matt]

Encryption could (perhaps should) be used, but by definition encryption is reversable, so it doesn't particularly add much in terms of real security.

 

As I explained via your ticket regarding this, the proper solution for this would be for Enom to provide a better and more secure way to interface with their API rather than requiring passing the password in plain text. We have been petitioning them for some time now to implement some kind of API Key/Token system as an alternative to the password, but they have seemed a bit reluctant so far.

 

Matt

[laszlof]

Encrypting it in the database ensures that it would be highly difficult to decrypt should a SQL injection be found. While it wont protect against much more than that, its still slightly better than being not encrypted at all. My 2 cents.

[vincent_g]

Also for bigger hosting companies this helps prevent employee theft.

An employee can just look into the tables and gain access to a company's Enom account.

If he is angry at the company he can cause a lot of problems.

 

Don't look at security from a standpoint of only outside security.

 

Also if you are looking at security as being reversable then there is no security.

It's only reversable if the person has a copy of your encription scheme.

Yes they can get a copy of your software but this then leaves a trail.

 

That's only a small sample of my viewpoint - lol

Edited March 5, 2012 by vincent_g