The attached patch adds a login reminder option when creating bookmarks, which is turned off by default. When an administrator turns it on, users have optional Username and Password textfields to enter login information about each bookmark. Login reminders display on each users' bookmark page. It involves a DB table modification to add uname and pword fields.
If I get a +1 I'll go ahead and commit.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | login_reminder.patch | 10.85 KB | deekayen |
| bookmarks_login_reminder.patch | 9.77 KB | deekayen |
Comments
Comment #1
deekayen commentedUpdate needed to match http://drupal.org/node/27109
Comment #2
deekayen commentedUpdated to work with changes from http://drupal.org/node/27109
Comment #3
matt westgate commentedWhat use cases are you trying to solve? If I'm understanding this patch correctly, I don't want bookmarks module storing my login information for other sites. Let the browser do it instead.
Comment #4
deekayen commentedYou named exactly the flaw in password management I'm trying to plug. My website users often don't use the same computer, so they need a different way to centralize their login reminders.
The objection I keep hearing to this patch is it complicates a simple module, but it is turned off by default. You have to go to the Administer area to turn it on. I thought that would make it a sure thing for others to accept it.
Comment #5
matt westgate commented-1
It's not the complexity I'm concerned about but rather the security risk. I'm simply not comfortable with placing the burden of password management to this module. Who knows what some folks may store in those fields? Bank account access info, Ebay info, blech.
On a side note, if you're users are on different computers often, chances are they're using public machines. You may want to add some additional security features such as using form_password() to mask password input and also store passwords encrypted in the DB. I'd probably even display passwords encrypted by default with an un-encrypt checkbox next each one or something.
Comment #6
deekayen commentedI'm still interested in getting this committed. What if I added a javascript implementation of AES? Again, everything I've done in this patch so far has been optional to enable and off by default.
Comment #7
deekayen commentedadding to my fork