My WebMoney Linux stores the password in clear text

Question

linux

This is not a question, but a warning.
I recently installed "My WebMoney" under Linux and found that the password for accessing the program is stored in clear text in "~/.weblaf/wmd.security.xml". And I set the password the same as for accessing the account (for convenience) and I felt a little uncomfortable from such an opening.
Well, since in Q / A, the question is: is this really considered normal and is it supposed to be?

Answer 1

Perhaps, there is a calculation that only the owner of the account should have access rights to the file (for example, rights 0400 or 0600).
Many systems store passwords this way. After all, the file cannot be read from the outside by standard methods to someone else.
Otherwise, even an encrypted password can be decrypted, because the key will need to be stored on the same machine in the webmoney binary. That is, the key can potentially be extracted, and then the encryption of the password will not make a big difference.

Answer 2

it is not considered normal to set the same passwords, look for the problem in your head.

Answer 3

How do you imagine autologin if the password is stored encrypted on the computer? Well, that is, either you, like in ssh, decrypt it yourself every time (and why then save it?), Or - it is stored in an open (well, or reversibly encrypted) form. In the second case, you can not decrypt it, copy the profile to another computer, and it will pick up.
An example for you is Skype. I don’t know how he stores encrypted passwords there, but I take a profile, copy it - it works. This means that Skype is able to decrypt and use the saved password without my participation, which means that the password can also be stolen from it. And from firefox you can. And in general, any program with a checkmark “remember password” works like this.

Answer 4

No, it's not normal. Security at the file access level is not enough. After all, there are enough holes in the software that a person may use (only firefox + flash has more than a dozen exploits to get a local file over the past couple of years)
SSH, for example, can encrypt keys with a phrase. Some clients store a password hash and a token or authorization key from the server (so as not to force the user to enter a password). Or other approaches.

Answer 5

You understood me wrong. This password is not for autologin, but for starting the program. I just made it the same as for the webmoney login, so as not to remember another password. And I thought that in this case it would simply store the hash of the password.