Skip to content

[Bug] passwords are stored in plain text in winboat host #235

@aquast

Description

@aquast

What version of WinBoat are you running?

Beta v0.8.5 Prod

Your Environment

OpenSuse Tumbleweed
KDE with wayland
FreeRDP from Distro

Steps to Reproduce / Context

Reading winboat.log at /home/user/.winboat/winboat.log with

tail -f /home/user/.winboat/winboat.log

Logs

         "Name": "🖥 Browser Display",
        "Source": "internal",
        "Path": "http://127.0.0.0:8006",
        "Usage": 0
    }
]
2025-10-06 16:09:31 | INFO | Launching app: ⚙ Windows Desktop at path WINDOWS_DESKTOP
2025-10-06 16:09:31 | INFO | Using FreeRDP Command: 'xfreerdp'
2025-10-06 16:09:31 | INFO | Launch command:
xfreerdp /u:"user" /p:"myPlainPassword" /v:127.0.0.1 /port:3389 /cert:ignore +clipboard +f /sound:sys:pulse /microphone:sys:pulse /floatbar /scale:100 /compression &
2025-10-07 19:56:30 | INFO | Final USB database file path: /usr/share/hwdata/usb.ids
2025-10-07 19:58:24 | INFO | Starting WinBoat container...
2025-10-07 19:58:25 | INFO | Container response: WinBoat

Expected Behavior

Passwords should be stored encrypted and never displayed in log files.

Current Behavior

I learned from winboat.log winboat is calling FreeRDP with password in plain text. Additionally it displays the password as plain text in the log.

In conclusion this means the password is stored in plain text too.

Possible Solution

Store passwords encrypted and call FreeRDP with an encrypted password

Quality Notice

  • I have checked the issue tracker and verified that this bug is a unique case.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions