diff --git a/android/app/src/main/java/info/varden/hauk/MainActivity.java b/android/app/src/main/java/info/varden/hauk/MainActivity.java index 67a7e7d..09b48d9 100644 --- a/android/app/src/main/java/info/varden/hauk/MainActivity.java +++ b/android/app/src/main/java/info/varden/hauk/MainActivity.java @@ -70,26 +70,13 @@ public class MainActivity extends AppCompatActivity { setClassVariables(); loadPreferences(); - // Add an on checked handler to the password remember checkbox asking the user if they - // really want to store their passwords. Passwords can only be saved in plain text, so this - // could be a security risk. It's therefore a good idea to inform the user about this. + // Add an on checked handler to the password remember checkbox to save their password + // immediately. chkRemember.setOnCheckedChangeListener(new CompoundButton.OnCheckedChangeListener() { @Override public void onCheckedChanged(CompoundButton button, boolean checked) { if (checked) { - diagSvc.showDialog(R.string.passwd_title, R.string.passwd_body, new Runnable() { - @Override - public void run() { - // If OK: Save the password right away. - setPassword(true, txtPassword.getText().toString()); - } - }, new Runnable() { - @Override - public void run() { - // If cancel: Undo the change. - chkRemember.setChecked(false); - } - }); + setPassword(true, txtPassword.getText().toString()); } else { setPassword(false, ""); } diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml index 9e4c6e9..3467b89 100644 --- a/android/app/src/main/res/values/strings.xml +++ b/android/app/src/main/res/values/strings.xml @@ -14,9 +14,6 @@ Stop sharing [%s] Share tracking link - Remember password? - If you save your password, it will be saved to the device in plain text. You are advised to use a password that you do not use elsewhere, such as a randomly generated password, if you choose this option. - Location sharing inactive Waiting for initial GNSS fix... Location sharing active! diff --git a/backend/include/config.php b/backend/include/config.php index e198fd4..fc42ea2 100644 --- a/backend/include/config.php +++ b/backend/include/config.php @@ -16,6 +16,12 @@ // Default value above is empty string (no password) and is VERY INSECURE. // Trust me, you really should change this unless you intentionally want a // public instance that anyone in the world can use freely. +// +// Also note that users have the option to save the server password locally on +// their devices using a "Remember password" checkbox. If they choose to do so, +// the password will be stored in plain text (unhashed) on their devices. You +// are encouraged to generate a random password to prevent risks associated with +// credential reuse, should the password somehow be leaked from their devices. // Leaflet tile URI template for the map frontend. Here are some examples: //