Website icons in plain sight

[Ivarson]

why are you not encryping or at the very least obfuscating the names of a users cached favicons when this is enabled?

I know, the icons are only cached on each device not synced to the cloudproviders, and if your OS content can be read by someone else it cannot be assumed to be secure yadayada.

But on a shared- or work-related machine, Im pretty sure a Enpass-user expects the entries to be confidential as well.

So if someone has a strange affection to... crows, whatever, there will be a  login.ilovecrows.com within %AppData% or the portable directory. If someones has several hundred entries, it gives quite alot intel about that person..

This applies to the Portable versions as well, so having website icons enabled on Enpass Portable on a USB stick means youre running around with all the URL's in your vault unencrypted..

There's no disclaimer or warning in Enpass about this, nor on the link https://www.enpass.io/support/kb/beta/what-happens-when-i-enable-website-icons/ that you provide from within Enpass.

Just store them within the main vault and save your API's some queries, or at least encrypt them separately..  

Edited June 14, 2021 by Ivarson
screenshots

[Vinod Kumar]

Hi @Ivarson,

Thanks for bringing this into our notice. You are right we should have provided a better warning message.

Icons are not treated as sensitive data and are for UI enhancement only. Obfuscating cache filename can avoid causal guessing but will not resolve the problem completely. Also, different devices resolutions, scrolling performance issues & complex updating mechanisms are few situation where we decided to avoid storing them in the main database. This was a trade-off decision we made than. Maybe it’s the time we look for alternate strategy that satisfy all the requirements.

Thanks.