Skip to main content
  • EN

Just a minute ago I did discover something I did not know yet: it is possible - to my surprise - that it is possible to retrieve a password stored in a User Parameter using a simple ParameterFetcher!

Passwords stored in User Parameters are encrypted (see e.g. this post), but the ParameterFetcher just returns the decrypted password in plain text... :-(

So everybody with access to a workspace with passwords and FME Workbench can just use this fetcher to retrieve all passwords.

OK - maybe I have been a little naive... 🙂 But this is surely something to take into consideration.

Aye, this is why Database- and WebConnections exist.

And why later versions of FME will always offer to password-protect a workspace that contains a password. Still, this is good to know!

Yeah, it's a fairly well known issue. Unless you're using web- and database connections, in my opinion there's not really any realistic way of protecting the passwords from someone that can modify or replace the workspace.

Thanks for all your answers. Did implement a Web Connection to secure my credentials 🌻

And why later versions of FME will always offer to password-protect a workspace that contains a password. Still, this is good to know!

If I understood well, password protection on workspaces is also limited, as the software is able to decode it, correct?

If I understood well, password protection on workspaces is also limited, as the software is able to decode it, correct?

You may want to look at the answer to "How secure is a password protected workspace?" here: https://community.safe.com/s/article/password-protection-for-fme-workspaces

"I tried a number of ways to view a protected workspace in a text editor, or otherwise access the content, and couldn't."

Yeah, as an official response that's a bit... lacking... Personally I wouldn't consider the workspace password protection as anything more secure than a hindrance to the average viewer.

If I understood well, password protection on workspaces is also limited, as the software is able to decode it, correct?

To be fair, I seem to recall Safe mentioning this a number of times: the password protection won't hold up to serious cracking attempts.

Reply


Community Stats

30,162
Posts
114,483
Replies
37,809
Members
Terms & ConditionsCookie settings
A product of
Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.