Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It only takes a minute to sign up.
Sign up to join this community
QGIS is the main GIS application used at my workplace. Access to the plugin repository has recently been removed due to a perceived security risk relating to the way QGIS stores proxy settings, including user passwords, as below (from the QGIS configuration page).
Is there a way to stop QGIS from saving and retaining records of these details, and instead requiring users to enter them each time they access plugin repositories?
In QGIS 2.14 an authentication system support for the plugin manager has been addded, maybe that's what you're looking for.
You can access the feature by going to Plugins > Manage and install plugins > Settings. When you select a repository you can use the edit button to open its settings, therunder you can find the new entry for authentication.
If this is the issue in qgis where it stores the users network details in text in the registry then yes it is a security issue but only if you are on a secure network like a council government or large developer. Not a problem for most of us though. Qgis really should encrypt this info as that is the basic for most apps. Other posts say they fixed this in 2.12 but that is not correct. Still does it in 2.14. Checked mine just now.
if your proxy requires authentication and this is the case in most secure networks then you cannot access any internet resources via qgis as the program stores your username and password in plain text which anyone can access. as most secure networks use some form of passthrough authentication for internet access then this username and password will be the same one you probably log onto your work computer with. you might as well write your username and password on a note and stick it on the side of your screen. this has been raised before and there is no interest in providing basic encryption for password storage in qgis. see this post here for some more info on poor password security used by qgis. https://hub.qgis.org/issues/8180 http://lists.osgeo.org/pipermail/qgis-user/2012-February/015555.html
