Bug 3477 - Store patron OPAC passwords in plain text
Summary: Store patron OPAC passwords in plain text
Status: CLOSED WONTFIX
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: rel_3_0
Hardware: PC All
: P5 - low enhancement (vote)
Assignee: Galen Charlton
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-08-02 06:01 UTC by Jane Wagner
Modified: 2012-10-26 00:40 UTC (History)
1 user (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 01:11:09 UTC


---- Reported by jwagner@ptfs.com 2009-08-02 18:01:10 ----

Sponsored by East Brunswick Public Library, East Brunswick, NJ, USA.

Library staff wanted to be able to see patron passwords when patrons forget the password and ask.  Created a system preference StorePasswordPlaintext and a new borrowers table column named password_plaintext. For non-staff accounts, the current password will appear in the Change Password box on member-password.pl.  The code will not display staff account passwords.

Plaintext passwords can only be stored for patrons added or patron passwords edited after the syspref is turned on; it cannot retroactively convert existing passwords.  Thus, if this capability is desired, the feature must be present and the syspref turned on before patron import.  Libraries should consider the security implications of having plaintext passwords visible.



---- Additional Comments From gmcharlt@gmail.com 2009-08-04 01:17:09 ----

(In reply to comment #0)
> Sponsored by East Brunswick Public Library, East Brunswick, NJ, USA.
>
> Plaintext passwords can only be stored for patrons added or patron passwords
> edited after the syspref is turned on; it cannot retroactively convert existing
> passwords.  Thus, if this capability is desired, the feature must be present
> and the syspref turned on before patron import.  Libraries should consider the
> security implications of having plaintext passwords visible.

This worries me, particularly if *staff* passwords are also stored in plaintext.  Although it may be water under the bridge with respect to the sponsoring library, typical best practice for password security is to store a password as a one-way hash, and if a patron forgets their password, have the library *reset* it rather than read it off to the patron.




---- Additional Comments From mjr@ttllp.co.uk 2009-09-25 19:54:52 ----

(In reply to comment #1)
> This worries me, particularly if *staff* passwords are also stored in
> plaintext.  Although it may be water under the bridge with respect to the
> sponsoring library, typical best practice for password security is to store a
> password as a one-way hash, and if a patron forgets their password, have the
> library *reset* it rather than read it off to the patron.

I agree: addition of this syspref appears to be a security bug.  It would also prevent a koha login being proof of a user's activity in any security breach. I'm surprised if this isn't against privacy laws in the US, but I'm often surprised by how weak US privacy safeguards are.

Should this request be resolved as a WONTFIX?




---- Additional Comments From nengard@gmail.com 2009-09-26 00:23:12 ----

I also don't think this is a very safe idea.  I'm also not sure why the librarian can't simply reset the patron's password when they ask what it is - seems easier and to require no development.



---- Additional Comments From jwagner@ptfs.com 2009-09-26 13:28:40 ----

We wrote this at the request of the site, and are obligated to submit it, but we understand the security implications and are prepared to maintain it locally for this site if it seems advisable not to accept it into the main Koha code.



---- Additional Comments From jwagner@ptfs.com 2010-04-28 15:26:39 ----

This feature has been abandoned, and I am closing the bugzilla entry.



---- Additional Comments From mjr@ttllp.co.uk 2010-04-28 15:38:01 ----

Correcting resolution tag.




--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:11 UTC  ---

This bug was previously known as _bug_ 3477 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3477

Unknown operating system Windows 2000. Setting to default OS "All".
Actual time not defined. Setting to 0.0
The original reporter of this bug does not have
   an account here. Reassigning to the person who moved
   it here: chris@bigballofwax.co.nz.
   Previous reporter was jwagner@ptfs.com.
The original assignee of this bug does not have
   an account here. Reassigning to the default assignee
   for the component, gmcharlt@gmail.com.
   Previous assignee was kohaprogrammers@ptfs.com.
CC member mjr@ttllp.co.uk does not have an account here