Idea for Zimlet - Password Manager

[Ericx]

Something like keepass. Could be real simple though.

Schema:
* unique id
* zimbra user id
* Easy to recognize name for link
* url to logon page
* username
* password
* username field name (from html page to simulate post)
* username password field name (from html page to simulate post)

Might require some IT install work like setup a mysql database to store all the info.

Behavior:
1. User right clicks on the zimlet shows list of web sites that have been entered. User
2. single click or double click open the add new website form.

[JoshuaPrismon]

Originally Posted by Ericx

Something like keepass. Could be real simple though.

Schema:
* unique id
* zimbra user id
* Easy to recognize name for link
* url to logon page
* username
* password
* username field name (from html page to simulate post)
* username password field name (from html page to simulate post)

Might require some IT install work like setup a mysql database to store all the info.

Behavior:
1. User right clicks on the zimlet shows list of web sites that have been entered. User
2. single click or double click open the add new website form.

sounds like a good application for a zimlet. However, there are a lot of things to be careful of here:

• Need to make sure that the connection is encrypted. Passwords over plain text == bad
• Check out ajaxian.com. They recently had a article about a javascript encryption library.

[Ericx]

Good point. Maybe there should be something that checks to see that the client is using ssl and warns or prevents them when they login.

But let me ask if the user is logged on via ssl, then when the new window is opened and the post is done wouldn't it be the same risk as if you went to the site and logged on?

One other security concern I have is the passwords being stored in mysql, but the zimlet can use the logonpassword as a master encryption protection to pull the other passwords out of mysql? Does that make sense - sort of like with keepass you can't see use the other passwords until you enter the master password.

Also, I think keepass is written in Java - maybe a wrapper with a few hooks could work?