Cyberduck Mountain Duck CLI

#976 closed enhancement (wontfix)

Store passwords in the bookmark, not in the keychain?

Reported by: macmillan Owned by: dkocher
Priority: normal Milestone:
Component: core Version: 2.7.1
Severity: normal Keywords:
Cc: Architecture:


I would like to request an additional feature of being able to store passwords within the bookmark rather than within the keychain, so that the complete bookmark (with URL, username and password) can be copied to other computers as needed. Currently there is only one known FTP program that does this, Vicomsoft FTP Client, and their program isn't nearly as nice as Cyberduck (and Vicomsoft hasn't been updated in at least three years). Without this ability our users would lose a fair amount of time since they'd have to look up every FTP account password (we currently have about 300 different accounts). We'd appreciate the addition of this feature or, failing that, instructions on how Cyberduck might be 'personalized' for us to provide this feature. Thanks.

Attachments (1)

Nö (541 bytes) - added by web76412 on May 16, 2010 at 9:33:57 AM.

Download all attachments as: .zip

Change History (8)

comment:1 Changed on Dec 4, 2006 at 2:42:02 PM by macmillan

  • Type changed from defect to enhancement

comment:2 Changed on Dec 5, 2006 at 8:38:21 PM by macmillan

BTW, I have spoken to my supervisor here and I was told that the company would be happy to make a donation to the Cyberduck project if this feature were added to it. Thanks.

comment:3 Changed on Dec 9, 2006 at 10:31:13 AM by dkocher

Cyberduck does not save passwords in its bookmarks because it would either be inherently unsafe if written as plain text or I would have to write my own security measures etc. which means a lot of duplicated work of what the Keychain already provides. You can also copy keychains to other machines; Cyberduck stores the passwords in the ~/Library/Keychains/login.keychain.

comment:4 Changed on Dec 11, 2006 at 2:18:05 PM by macmillan

Yes, I understand that Cyberduck does not save passwords in its bookmarks but instead uses the keychain. But I didn't ask why Cyberduck does this; I asked if Cyberduck could incorporate the feature of storing the password in the bookmark, even as an option. (So you don't have to abandon using the keychain. Just make using the keychain the default, but optionally allow passwords to be stored in the bookmark.)

Copying the keychain is not an option. Here's the situation: I help support about 150 FTP users. When a new FTP account is created, I create an FTP bookmark (using the Vicomsoft FTP Client software) and email that bookmark to the person(s) who requested the FTP account. All they need to do is add the bookmark to their Vicomsoft bookmarks folder and that's it -- zero configuration on their part. There is no security concern since all FTP accounts are on the same server and the bookmarks never leave the corporate network. This provides a very simple means of adding new bookmarks to users' systems. It is this functionality which is unique to the Vicomsoft software that I wish to see implemented into Cyberduck.

Yes, I could create a single keychain that has all of the account passwords in it and install it on everyone's computer, but what happens when a new account is created? I would have to reinstall a new keychain into everyone's computers, and then the users would lose whatever passwords they had added to the keychain. So you see, using the keychain is not an option.

So, to recap: I'm not asking you to abandon using the keychain. I'm asking for an additional, optional feature wherein the password could be stored within the bookmark. Thanks.

comment:5 Changed on Dec 18, 2006 at 11:04:00 PM by dkocher

  • Milestone set to 2.7.2
  • Status changed from new to assigned

comment:6 Changed on Dec 19, 2006 at 8:56:31 PM by dkocher

  • Milestone 2.7.2 deleted

This is however more complicated to implement than it might sound like, because I don't want passwords to be in bookmark files as plain text. To encrypt and decrypt the passwords one would have to store a secret key somewhere, e.g. in the Keychain. Therefore you would still have to add the key to every computer that wants use the bookmarks with the encrypted passphrases.

comment:7 Changed on Jan 12, 2007 at 8:16:15 PM by dkocher

  • Resolution set to wontfix
  • Status changed from assigned to closed

Changed on May 16, 2010 at 9:33:57 AM by web76412


Note: See TracTickets for help on using tickets.