Export user account data

[deepseth (at) gmail (dotcom)]

The ability for clients to export their account data from a server, as a method of either:

a) backing up their settings
b) moving their settings to another bitlbee server (eg, from a public server to their own, or vice versa)

[wilmer]

This is a nice idea, however, there's one problem. Right now it's not possible to get the IM passwords from BitlBee. You enter them once, and BitlBee will keep them for itself. With an export-system this little piece of security would disappear.

I don't know if that's a good thing.

[mbs]

it might not be a much worse thing than the security risks that are already present. bitlbee, IRC, and IM in general aren't really security land, anyhow.

[deepseth]

What if the password wasn't exported then? And apon importing the account settings, it prompted for the account passwords? (and then sent them to whatever blackhole bitlbee keeps it in)

[eydaimon - nefar@…]

fyi, I'd like to be on the CC list for this bug.

deepseth has a good point. The passwords for the various protocols would be sufficient. In order to be able to export the accounts to begin with, you would have had to log on. The only reason to export settings is to save all the renames etc.

I also propose a possibility of an import of settings as well as an export.

Export and import could both happen via a DCC connect where the settings are sent as a file or tarball or whatever makes sense.

The only things that actually need to be trasmitted are: Protocol account logins, and the user renames etc that people have done for the various account.

Export no passwords for any accounts.

[wilmer]

Okay, I put you on the CC list. Right now I'm thinking of implementing this, and making it configurable (at runtime/compile time or whatever).

[eydaimon]

go wilmer :) That will make it excellent for those who want to try it out on a public server before installing their own, or what not.

[Jelmer Vernooij]

I think this feature is a good idea.

[anonymous]

well, what if someone imports a bad user account data? i think this feature should not added to bitlbee. or it is just me that i'm too paranoid about data thieves.

[nefar@…]

I think you have to expand on that. How does importing bad user data enable anyone to "theive" anything?

[deepseth (stillatgmaildotcom)]

Any updates yet? :)

[wilmer]

Not really, but we got a dupe of this bug now. :-) #201

I still don't know what to do with this. It'd be the most useful on public servers, but exactly there I'd rather not have this functionality for security reasons...

[deepseth (gmailstillinvadesmyprivacy)]

Arse. I guess I might as well just bite the bullet and do all my renames again manually. Bleh.

[wilmer]

Arse.

I beg your pardon?

I can imagine the annoyance of the renames. But OTOH I think you'd also not be very happy if anyone could steal all your IM passwords once they get to know your BitlBee password. Making the information available to you means making it available to everyone, in theory.

[nefar@…]

Replying to wilmer:

Why do the IM passwords need to be stored with the export? We're only interested in exporting the contact list. passwords are easy and scarce to reenter. Renaming ALL the contacts on the other hand is much more work.

[deepseth]

Replying to wilmer:

Arse.

I beg your pardon?

Apologies, I did not intend to offend.

I can imagine the annoyance of the renames. But OTOH I think you'd also not be very happy if anyone could steal all your IM passwords once they get to know your BitlBee password. Making the information available to you means making it available to everyone, in theory.

Agreed. I just saw the MOTD on testing.bitlbee.org about the upgrade to storage-xml. Given this new format, wouldn't it be possible to export the account data by means of sending the user their account details in an XML document by DCC? Strip out the password field, and when importing the XML back into the new bitlbee server, have it prompt the user for the passwords for those accounts? Or as an easier short term idea, have the user manually update the XML file with their passwords? (ie, export XML with blank password fields)

Or am I still dreaming? Heh.

[anonymous]

I would love this feature!

[anonymous]

I was just thinking of this kind of feature a few weeks ago, and voila! it's already been discussed. This would certainly be a nice feature from my point of view as well. I don't see how it would affect security if passwords are not exported with the rest of the account data.

[anonymous]

Please remote me from the CC list. I stopped using bitlbee ages ago. Two reasons, this was one, the other was that there's no way to keep state wether I've read a message or not. That means if the server crashes or whatever, I loose which messages were unread. Since centerim offered this, and I can't see how this would be implemented through bitlbee (irc client maybe), I abandoned bitlbee.

[eydaimon/nefar]

previous post was me, btw. nefar@...

[wilmer]

Recent versions of Trac seem to automatically Cc everyone who posted with their full e-mail address filled in instead of just a nickname. The only way I can remove you completely is most likely by editing the database directly. I'll give that a try now.

Yes, proper acknowledgement of received/read messages via IRC is hard to implement.