Atlas SQL ODBC stores password as clear text

XMLWordPrintableJSON

    • Type: Investigation
    • Resolution: Works as Designed
    • Priority: Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None

      When you create a DSN in ODBC Administrator, using the "MongoDB Atlas SQL ODBC Driver" then everything is working fine. However the password is stored as clear text in your registry and in case of "System DSN" is can be simply retrieved by anybody who gained access to the computer.

      C:\>reg query "HKEY_CURRENT_USER\Software\ODBC\ODBC.INI\MongoDB"HKEY_CURRENT_USER\Software\ODBC\ODBC.INI\MongoDB
    Driver    REG_SZ    C:\Program Files\MongoDB\Atlas SQL ODBC Driver\bin\atsql.dll
    enable_max_string_length    REG_SZ    0
    simple_types_only    REG_SZ    1
    User    REG_SZ    admin
    Uri    REG_SZ    mongodb+srv://cluster0.tppqria.mongodb.net
    Password    REG_SZ    secret
    Database    REG_SZ    mip
C:\>

      I am using latest version if Atlas SQL ODBC Driver, 2.0.5

      I don't think in terms of security, this is very smart. The password should be prompted at connection or at least it should be stored as an encrypted value. 

      Kind Regards
      Wernfried

       

            Assignee:
            Unassigned
            Reporter:
            Wernfried Domscheit
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: