[JENKINS-15915] Password Parameter should not be stored (on disk)

Type: Bug
Resolution: Not A Defect
Priority: Critical
Component/s: core, mask-passwords-plugin
Labels:
- cleartext
- disk
- parameter
- password
- security
- stored
- unencrypted
Environment:
Debian Linux Stable, Jenkins 1.462, Sun JDK 1.7

The Mask Passwords Plugin helps masking the password in Jenkins' GUI.

Unfortunately the passwords are already stored clear text on disk.

They should not be stored. Storing them symmetrically encrypted is not necessary too, I think, as they are/should only used one time.

Thomas Lehmann created issue - 2012-11-25 10:32

Gregory Boissinot made changes - 2012-12-25 19:57

Component/s

New: mask-passwords [ 15761 ]

Jesse Glick made changes - 2014-06-30 18:51

Resolution		New: Not A Defect [ 7 ]
Status	Original: Open [ 1 ]	New: Resolved [ 5 ]

Jenkins IRC Bot made changes - 2014-09-27 15:39

Component/s		New: core [ 15593 ]
Component/s	Original: parameters [ 15594 ]

R. Tyler Croy made changes - 2016-07-25 23:55

Workflow

Original: JNJira [ 146717 ]

New: JNJira + In-Review [ 192051 ]

Jenkins