Skip to content

Encrypt mongodb key #1463

Description

@VakarisZ

Is your feature request related to a problem? Please describe.
We hold mongodb key on the same machine as the island, so if anyone can access the island and steal the database, they can steal the key as well and decrypt everything

Describe the solution you'd like
Encrypt mongodb key on registration. On start/login decrypt the key and use it from memory

Describe alternatives you've considered
Please describe alternative solutions or features you have considered.

Tasks

  • Delay mongo initialization after registration (0d) - @shreyamalviya @VakarisZ
    • Clear database on registration
    • Update documentation with a note that says if you reset your password the database will be cleared.
  • Refactor Encryptor (0.25d) - @shreyamalviya @VakarisZ
    • Create encrypted mongo key on registration.
    • Decrypt mongo key on login
  • Manual with AppImage, Docker, and MSI (0.5d)
    • Make sure to test reset password proceedure

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions