[dev] Initial configuration setup suggestion

[Kevin Myer]

Quoting Jan Schneider <jan at horde.org>:

Wizard would be great for Setup, or even just the idea of a Basic and an
Advanced setup view.  Basic acts kind of like a wizard, setting some other
values based on what you chose previously, Advanced gives you full access to
all the options, like Setup does now.

> No, we even changed them to clear text fields in the past. Password
> fields gain you nothing in an interface that only admins have access
> to. Even in your case, the users could simply look at the HTML source
> code to reveal the passwords.

Administrators may give trainings in a public or lab setting.  Or they may be
sitting at their desk, with someone watching over their shoulder.  Its 
just bad
to echo passwords to a screen in both cases.  I know they're in the 
HTML source
- thats not ideal but there's no real way around it that I can see.  If 
someone
can sit down at my desk and get access to the page source, I've got bigger
problems to worry about, like what else they can access from all the other
terminal windows I have open.

It amounts to security through obscurity to obfuscate the password, but 
for the
two situations above, its good enough, and its essential.  I hate seeing
plaintext anywhere, even in text config files (which are still observable by
someone glancing over your shoulder if you're in over a console or terminal
session).  Maybe the addition of a config key, that could be used to
crypt/decrypt "sensitive" items, like passwords.  Store it in a separate file,
have a way to tag certaion config items as "sensitive, and store "sensitive"
info in config files in a reversible hash - similar to whats done with storing
passwords in session data, using the Secret class and a cookie as the key.

Kevin
-- 
Kevin M. Myer
Senior Systems Administrator
Lancaster-Lebanon Intermediate Unit 13  http://www.iu13.org