Little Story
I have a little question about the Master Password in KNIME.
Some of my nodes are storing sensitive information in the preferences (like passwords).
I know that the preferences stuff will be saved unencrypted.
But I would love to be able to encrypt some of my fields in my preferences.
Question
Is it possible to use the KNIME master-password system to encrypt values in the Preferences Window?
Or is the master-password system only for the specific types in the Configuration Dialog?
It would be too bad if I have to âinventâ my own master password system just for my nodesâŚ
Hi imax,
Yes, it is possible to use the standard KNIME en-/decryption mechanism. This works fine within your node classes, but I have never tried to call it from within the preference page (if this is what you meant by Preference Window). In order to use the Master Key, you can call KnimeEncryption#decrypt() resp. #enrypt() which will launch the Master Key dialog. Give it a try!
Best, Thomas
Thank you very much. It works like a charm!
If someone needs the solution here we go:
String value = "superman"
// Encrypt
String crypted_value = KnimeEncryption.encrypt(value.toCharArray());
// KNIME will ask here for the MasterPW if not already entered.
// Decrypt
String plain_value = KnimeEncryption.decrypt(crypted_value);
Could anyone please clarify where the encrypted password is stored in case of using masterkey by Preference Window or the either case calling KnimeEncryption#decrypt() resp.
We connect to âDatabase connectorâ node with credentials stored in config files so far. But due to security issues, the credentials should be encrypted before passing to âDatabase connectorâ node.
With few findings and recent studies, iâve incorporated below method to connect to DB.
I would like to know where the encrypted password is stored in the backend if I am using below âcredential inputâ node. Could you please clarify on the same..
Would that be the recommended approach? If not please let me know the best approach to encrypt/decrypt password. I have been using knime for about two weeks and itâs great so this could be simple but Iâm overlooking also Google doesnât seem to be pulling anything up either.
Note: Unfortunately I am using KNIME older version (below V3) so unable to incorporate credential configuration node into my workflow or any other advanced features either.
Is there any reason why you use such an old AP version? The newest 2.x version (2.12.2) is from 2015.
However, the screenshot you posted does not look like that version. Can you please specify which version you are using?
In recent versions of KNIME AP, we have added greatly enhanced encrypted credential handling, which should satisfy your requirement, this includes a dedicated credentias flowvariable type that uses encrypted credentials which are not persisted to disk unless this is explicitly configured.
Due to organization limit we are using older version 3.5.3. We shall update to new version soon. For time being, we shall incorporate this encryption approach in our code. Could you please help us in knowing where the encrypted password is stored in backend for security purpose.
If this checkbox is not checked, credentials are only saved in memory and never persisted to disk, this means users have to enter them every time they execute the workflow, but it is much more secure.
If you check this option, the credentials are stored (weakly encrypted) in the settings store of that node, which is part of the workflow files. Anyone with access to that workflow will be able to use these credentials, either by importing the workflow to their KNIME AP or by cracking the encryption.
@gab1one please let us know on what encryption algorithm is being used to encrypt the password stored in workflow files? And how the key used for this encryption is managed in Knime?
Passwords saved with a workflow are NOT secure, access to the workflow file allows anyone to use and restore the password. As any AP version can read that workflow and use the keys.
Instead, use credential flow variables and configuration nodes without storing the passwords.
When configuring a schedule on the KNIME server, stored credentials entered during the workflow configuration are encrypted on a per workflow schedule basis. This means they donât suffer from that problem. If you have more security questions, you can also reach out to us directly at support@knime.com so we can setup a call.
.