This problem occurs with the default configuration:
- in the Petals CLI preference file, the passphrase is set to its default value,
- the Petals container used has its own default configuration.
As both passphrases match, the sensible information is returned.
In a security point of view, no passphrase should be set at alias level. In a user-friendly point of view, it should be better to be able to set the passphrase at alias level.
As the security is more important in production environment than in development or test environments, the default configuration of Petals CLI must adapted:
- no default passphrase set for production environment (ie. in Debian packages),
- a default passphrase set for development and test environments (ie. in ZIP packages).
Bug
Resolved
Major
This problem occurs with the default configuration:
As both passphrases match, the sensible information is returned.
In a security point of view, no passphrase should be set at alias level. In a user-friendly point of view, it should be better to be able to set the passphrase at alias level.
As the security is more important in production environment than in development or test environments, the default configuration of Petals CLI must adapted:
- in the Petals CLI preference file, the passphrase is set to its default value,
- the Petals container used has its own default configuration.
As both passphrases match, the sensible information is returned. In a security point of view, no passphrase should be set at alias level. In a user-friendly point of view, it should be better to be able to set the passphrase at alias level. As the security is more important in production environment than in development or test environments, the default configuration of Petals CLI must adapted: