Don't Show Password in RDP Tab : Royal Apps

J

James

started a topic 3 months ago

If Royal TSX is opened using a rtsx:// url with an (URL-encoded) embedded rdp:// that includes a password (as most rdp:// urls would), that password can be easily seen just by clicking on the tab and copy+paste.

In fact, it's easy enough to drive by someone else's machine and just click on it to see their password.

While one option is "don't use Royal TSX this way", a better option would be to simply mask the password before putting the URL in the tab.

NOTE: I know some organizations would consider this a security issue, but I was recommended to publish this here. I hope that's alright.

Felix Deimel

said 3 months ago

Just to clarify: By "Tab" you actually mean it shows up in the ad hoc computer name field in the toolbar, right? Thx, Felix

J

James

said 3 months ago

So from here...

Felix Deimel

said 3 months ago

Hi James,

thx for the screenshot. I was worried that the whole connection string would show up in the tab title after your initial description. Thankfully it does only show up in the ad hoc computer name field which is by design at the moment.

For the next update, we'll not put the connection string into that box however if you pass it via the "rtsx://" URL scheme. So that should fix your issue.

cheers,

Felix

How can we help you today?