[GUACAMOLE-1599] Storage of TOTP secrets unhashed

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Invalid
• Affects Version/s: 1.3.0
• Component/s: guacamole-auth-totp
• Environment: Ubuntu 20.04
• Assignee: Unassigned
• Reporter: Andy Franks
• Created: 06/May/22 08:32
• Updated: 02/Apr/24 21:08
• Resolved: 02/Apr/24 21:08

Description

Hi

Successfully campaigned for the use of guacamole in the large public sector organisation I work at. A security-conscious colleague has noticed that apparently the TOTP codes for users are stored in the guacamole_user_attribute table in plain text - and presumably could be trivially copied to a TOTP utility and the codes generated.

I pointed out that the user security part is salted and hashed, and you'd need both to log in, but the colleague is not appeased.

Perhaps not a bug as such but possibly a spanner in the works of keeping the adoption of the software, which would be a big shame. Is there an official explanation (e.g. that it's simply not required as you'd need to get into the database first, the security is implicit there etc)? Or is it a future planned change?

Thank you