{"issue":{"user":{"id":146321,"login":"dragoonis","url":"https://api.github.com/users/dragoonis","gravatar_id":"290cdad0e6ff9caf01ca06f70cddc808","avatar_url":"https://secure.gravatar.com/avatar/290cdad0e6ff9caf01ca06f70cddc808?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"milestone":{"open_issues":4,"title":"0.9.1","created_at":"2011-06-08T00:12:08Z","creator":{"id":146321,"login":"dragoonis","url":"https://api.github.com/users/dragoonis","gravatar_id":"290cdad0e6ff9caf01ca06f70cddc808","avatar_url":"https://secure.gravatar.com/avatar/290cdad0e6ff9caf01ca06f70cddc808?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"state":"open","due_on":null,"closed_issues":14,"description":"This will include:\r\nthe new PPI_Request components\r\nunit testing","number":1,"url":"https://api.github.com/repos/dragoonis/ppi-framework/milestones/1"},"title":"PPI Hub - Github OAuth Encryption Algorithm","created_at":"2011-08-15T17:06:34Z","labels":[{"name":"task","url":"https://api.github.com/repos/dragoonis/ppi-framework/labels/task","color":"FFB440"}],"updated_at":"2011-12-21T18:49:00Z","state":"open","id":1408989,"html_url":"https://github.com/dragoonis/ppi-framework/issues/72","closed_at":null,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"body":"# Background\r\n\r\nFor the decision made to let the user base of PPI community be actually coming from github.com we have implemented the OAuth protocol into our apps using the \"PPI Hub\"\r\n\r\nWhen you get a new user confirming permission for the PPI Framework github app to be used with OAuth then we are given an \"Access Token\". This code never changes so we have to save the code against that user's DB record that we store.\r\n\r\nThis access token allows us to perform github operations on behalf of the user, such as making a ppi issue tracker comment which goes directly to github.\r\n\r\n# Context\r\n\r\nNow moving onto the actual topic of this discussion. We need to encrypt this access token as it's not safe to have it in plain text. As it has to be decryptable before we make Curl requests to gitub then we can't use one-way hashing algorithms such as **sha**.\r\n\r\n# Suggestion \r\n\r\nOne suggestion is to use **AES** to encrypt/decrypt the access token.\r\n\r\nMy personal suggestion was to use AES + a special key stored in the app's configuration file so even if the user got a hold of the encrypted form, and knew the algorithm to decrypt it they would need disk access to successfully decrypt the tokens.\r\n\r\nComments?\r\n","number":72,"url":"https://api.github.com/repos/dragoonis/ppi-framework/issues/72","comments":4,"assignee":null},"comment":{"user":{"id":146321,"login":"dragoonis","url":"https://api.github.com/users/dragoonis","gravatar_id":"290cdad0e6ff9caf01ca06f70cddc808","avatar_url":"https://secure.gravatar.com/avatar/290cdad0e6ff9caf01ca06f70cddc808?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"created_at":"2011-12-21T18:49:00Z","updated_at":"2011-12-21T18:49:00Z","id":3237809,"body":"@BenTheDesigner,\r\n\r\nPlease see the above comments about the 'encryption' format discussed for the oauth token.\r\nFor now, like we discussed please implement with plain-text for a functional prototype and then move forward with the encryption.\r\n\r\nThanks !\r\n\r\nFor new discussions, please open one at www.github.com/ppi/framework/issues","url":"https://api.github.com/repos/dragoonis/ppi-framework/issues/comments/3237809"},"action":"created"}