Passwords on Customer Portal

fold

Hello,

it would be great if customers could see their passwords (maybe with granular permissions on what pw they see, eg. a checkbox when creating the entry?).

This is a wish I've heard from countless customers.

Btw: Following the development of itflow for quiet some time now, absolutely great what you are doing!

wrongecho

Great idea, but is a little tricky to implement due to the way the passwords are encrypted on the backend. Note (in case you're not aware already) you can share passwords as a one-off using sharing links.

fold

Yes I have seen that, great feature for one time or specific uses but with more and more MFA usage, giving the customers credentials gets pretty tricky.

wrongecho

The issue is that it's almost impossible to achieve this securely.

The onky thing I can think of is to have a per-client encryption key and to store an extra copy of the credential encrypted with this. But that per-client key has to be stored somewhere - a database dump makes the encryption pretty worthless.

Any thoughts @johnny

johnny

I agree @wrongecho

and we would absolutely have to store the enc key per client in the DB and that would be totally unsafe. We could store the key per contact which would be safer.

Someone here also had the idea to do that per user so user can have their own personal passwords as well.

I would like to accomplish this but Lets save this one for after 1.0 as this will take some major changes underneath and set us back on the 1.0 release date.

fold

+1 on that, do not compromise security for anything.

Thanks for considering!