https://sourceforge.net/p/squirrel-sql/feature-requests/587/2020-01-23T18:14:04.453000ZRecent changes to 587: Password encrypted with a hardcoded password2020-01-23T18:14:04.453000Z2020-01-23T18:14:04.453000ZGerd Wagnerhttps://sourceforge.net/u/gerdwagner/https://sourceforge.neta0a3b075a6c1f7417700f079ba1f31340fe9b445

<div class="markdown_content"><p>Just to mention: There's a simple and secure workaround: In your Alias definition do not enter any password and uncheck "Auto logon".</p></div>

2020-01-23T14:47:36.627000Z2020-01-23T14:47:36.627000ZPedro Miguelhttps://sourceforge.net/u/pedromiguel23/https://sourceforge.netb5d5a35472d4885f660d70aee57f4b59e51c8d96

<div class="markdown_content"><p>It was added the possibility to encrypt the passwords used to connect to database. But the encryption key is hardcoded in code. Therefore, someone with access to code (or decompiled) can discover the encryption key and decrypt the passwords. Nevertheless, if I copy the configuration file from other machine, I can use its configuration, and without knowing the password, connect to the database.</p> <p>The password should be encrypted/decrypted by a master key, defined by the user. The user must enter the key on application startup (or on first use of a connection with encrypted password) and the password keep in memory for future use (to not reduce user experience).</p></div>