Documentation advises using an online QR code generator, may leak secrets
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 74/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- markdown
- Domain
- documentation
Research direction
The advice lives in content/client/android/_index.en.md, around line 73, where the page links to qr-code-generator.com for making the configuration QR code. Read the surrounding steps to see how the QR code fits into the setup flow. Done means the online-generator recommendation and its link are removed or replaced with wording that does not suggest sending the configuration string to a third-party website.
Written by the indexing model from the issue text.
Description
The documentation for the Android client advises generating a configuration QR code with an online generator, linking to https://www.qr-code-generator.com/.
The configuration string may contain a secret key as well as other confidential, albeit technically non-secret, information (for example, I chose a non-standard port for further obfuscation), therefore I am very skeptical on the security of this approach.
I would strongly advise against recommending using online tools for this, and against this provider in particular. I hold nothing against this generator, and regularly use it for personal and professional purposes, but this web app transmits the string as a query parameter, so the secrets are likely to be stored in some log somewhere along the way.
I do not endorse nor recommend the following offline tool, but I found that it generates a QR code that just works™ : https://sourceforge.net/projects/zint/
- Dominant language
- HTML
- Stars
- 808
- Forks
- 709
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 3
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rustdesk/doc.rustdesk.com
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
rustdesk/doc.rustdesk.com#612 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
rustdesk/doc.rustdesk.com#594 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 62/100
rustdesk/doc.rustdesk.com#557 · 1 comment · 2 reactions ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 57/100
rustdesk/doc.rustdesk.com#645 ·
-
Difficulty 3/5 Half a day Newbie friendliness 48/100
rustdesk/doc.rustdesk.com#637 ·
All issues in rustdesk/doc.rustdesk.com
Similar issues
-
documentation good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
eugenioenko/ttt#1000 ·
Maintainers usually reply within 1 day
-
documentation v2
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
modelcontextprotocol/servers#5170 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
SwiftKickMobile/skai#83 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
Maintainers usually reply within 1 day