Some passwords generated with rclone config may be insecure. In particular if you used the 'g' generate option with rclone v1.49 - v1.53.2 then your password will based on the second it was generated in. This means that there are fixed number of passwords in that period ~33 million.
See the checking tool which can check config file for insecure passwords
This was caused by a bit of careless refactoring by me - many apologies
FAQ for security issue
Am I affected?
If you have used rclone config to generate a password for you feature then you might be. Run the the checking tool to find out for sure
I've got an affected password - do I need to change it?
I recommend you change it, especially if it is for access to a remote service (eg FTP server).
What about crypt backends
I imagine most of these passwords are used in crypt backends.
For it to cause your private data to become public, firstly the encrypted data needs to become public, then the attacker would need to decode your encrypted data by guessing passwords.
If the attacker has no knowledge of when you made your key then there are about 33 million possible passwords. Because of the use of scrypt in rclone it takes about 50mS to check a key on my laptop. So to search the whole space would take about 19 CPU days which is a lot but well within reach of a determined attacker.
How do I change my crypt password
Unfortunately you will have to download and upload the data. The procedure would be:
create a new crypt wrapping a new directory on the existing remote
a password protected rclone.conf files, and the check less then one second
plain text .conf files and the check took 50s
each command had very different output
here is the output of both
passwordcheck c:\data\rclone\scripts\rclone.conf
*** No insecure passwords found
passwordcheck c:\data\rclone\scripts\rclone.plaintext.conf
2020/11/19 13:55:11 Looking through 39102911 seeds from seed 1566691200 generated at 2019-08-24 20:00:00 to seed 1605794111 generated at 2020-11-19 08:55:11 for 2 passwords of length 120 bits
2020/11/19 13:56:02 That took 51.235033s for 763206.515354 seeds/s
*** No insecure passwords found
@ncw thanks for patching rclone so quickly and making it easy to check. Thankfully I'm in the clear as downloading and uploading would have been a very arduous task for me.
The check only took 13.4s for me It used up 100% of my CPU so it'd be worth letting people know not to do it at an important time, as my work Teams call went bonkers for a few seconds!
root@Highlander:/mnt/user/public/passwordcheck# ./passwordcheck /boot/config/plugins/rclone/.rclone.conf
2020/11/20 15:19:04 Looking through 39194344 seeds from seed 1566691200 generated at 2019-08-25 01:00:00 to seed 1605885544 generated at 2020-11-20 15:19:04 for 18 passwords of length 304 bits
2020/11/20 15:19:17 That took 13.41996419s for 2920599.745654 seeds/s
*** No insecure passwords found
If the salt is a bad password then the security would rest on how good your password is. If it is a good one then you are effectively operating without salt which is OK if not recommended.
It does. However if you auto generated both password and salt then it will only detect the password as the random number generator will have moved on. You should change both if the password is a problem.
