make support string more secure #1900

Closed
opened 2026-04-06 02:37:25 +02:00 by MrUnknownDE · 0 comments
Owner

Originally created by @tessus on 11/23/2022

Opening this just as a reference.

When a support string is generated the masked entries still show certain info:

  • length of a password, user, database name in the DB URL
  • length of smtp username
  • domain length and TLD length, if subdomain is used or a sub directory
  • length and format of smtp_from

This change masks the fields with *** as it is done for passwords.

/ref #2878

*Originally created by @tessus on 11/23/2022* Opening this just as a reference. When a support string is generated the masked entries still show certain info: - length of a password, user, database name in the DB URL - length of smtp username - domain length and TLD length, if subdomain is used or a sub directory - length and format of smtp_from This change masks the fields with `***` as it is done for passwords. /ref #2878
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github/vaultwarden#1900