I'm considering using QuNect to connect a desktop application to QuickBase (a cloud-based database). QuNect creates an ODBC DSN, which requires a QuickBase username and its password or user token to connect. (A user token allows API calls to run with the permissions of the user, so it allows basically the same access as a password.) The DSN configuration screen looks like this:
I can't copy from the field password/user token field, and it's been hidden from view. However, I looked at the DSN in the registry, and it shows the password as plain text:
This password would allow anyone to access the app/database as the given user, which will necessarily have some read and write access. Is it a security risk to have a DSN with a password on a server that only trusted people have administrator access for? Should I be worried there are other security issues with QuNect because of this?