status-mobile/doc/decisions/0007-masking-sensitive-data.md

40 lines
1.2 KiB
Markdown

# 0007. Masking Sensitive Data
| Date | Tags |
|---|---|
| 2018-05-22 | e.g: architecture, security |
## Status
Proposed
## Context
We have some data that we don't want to appear in the logs (user passwords are
a good example). Currently, they are passed around as strings, that could be
printed out by mistake in a log entry (see https://github.com/status-im/status-react/issues/4053)
## Decision
To minimize the risk of leaking passwords through logs, we should not pass
passwords as strings in our codebase. We introduced a new type `MaskedData` in
`status-im.utils.security`.
We use `(security/mask-data <data to hide>` to wrap sensitive data into this
type and then use `(security/unmask <masked-data>)` to get the plaintext back.
It is important to keep that sensitive data masked as much as possible, until
you need the plaintext to pass to the extenral APIs.
Example:
```clojure
(println (security/mask-data "my-plaintext-password")) ;; Outputs "******"
(println (security/unmask (security/mask-data "my-plaintext-password"))) ;; Outputs "my-plaintext-password"
```
## Consequences
Tradeoffs:
- developers need to be aware of this type and have a clear separation where do
we use plaintext and where do we use masked datak