I'm considering using QuNect to connect a desktop application to QuickBase (a cloud-based database). QuNect creates an ODBC DSN, which requires a QuickBase username and its password or user token to connect. (A user token allows API calls to run with the permissions of the user, so it allows basically the same access as a password.) The DSN configuration screen looks like this:

QuNect DSN configuration

I can't copy from the field password/user token field, and it's been hidden from view. However, I looked at the DSN in the registry, and it shows the password as plain text:

QuNect password plain text

This password would allow anyone to access the app/database as the given user, which will necessarily have some read and write access. Is it a security risk to have a DSN with a password on a server that only trusted people have administrator access for? Should I be worried there are other security issues with QuNect because of this?

  • The ODBC string has the password in it anyway, so storing the ODBC string or the password alone makes no real difference. – grochmal Oct 24 '16 at 23:20
  • If you're really worried about it, maybe look into the SSO option, which avoids storing the password and instead ties the ODBC session to an LDAP user context. – John Wu Oct 25 '16 at 0:18
  • @JohnWu I don't think that will work for me, but thanks for the suggestion. – Kat Oct 25 '16 at 0:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.