nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

IT Security question on password encryption

Jeff_Upton

Hi,

A potential new client's IT Security team is vetting JMP prior to purchase. JMP's Help documentation gives us the location of the .jmp file where user ID+passwords are stored and notes that 'Your Google password is encrypted'; the Security team is now asking where the encryption key for passwords is stored.

Is this information handled at the OS-level (i.e. Credential Manager) or is JMP handling password encryption/decryption?

Also, is there an analogous location where this information (OAuthTokens.jmp on PC) is stored on MacOS?

Thanks!

Jeff

Accepted answers

Jeff_Perkinson

Note to self: Never reply after bedtime. My apologies.

I located the section of the documentation you were referring to. It's the About Importing Google Sheets section:

•Information that Google uses to authenticate your account is stored in C:/Users/<user name>/AppData/Roaming/SAS/JMP/OAuthTokens.jmp. (Your Google password is encrypted.) This enables you to import and export data using the same Google account without providing the authentication information again. Note that a user with access to your computer’s user account has access to all of your Google spreadsheets. If they contain confidential information, reconsider sharing your user account.

The oauthtokens.jmp on a Mac is in ~/Library/Application Support/JMP.

Based on what's in my oauthtokens.jmp I still don't believe we are storing passwords, but @briancorcoran can help confirm.

NB: I added the Length[] column below to show that the password field is empty.

2021-03-01_21-16-56.017.png

briancorcoran

Thank you Jeff Perkinson, you are correct. We do not store passwords, but access tokens that may expire depending on the service you are using.

Brian

All comments

Jeff_Perkinson

I assume you're talking about the Security section of the OAuth 2.0 for Web APIs section:

OAuth tokens can contain sensitive information. Depending on the grant type, you might need to provide your password or a client secret. JMP automatically handles this information for you.

Information that Google uses to authenticate your account is stored in C:/Users/<user name>/AppData/Roaming/SAS/JMP/OAuthTokens.jmp. (Your Google password is not stored.) After using an OAuth token on your personal account, you can delete all columns except for User and Client ID. Keep in mind that if you need to share your script, others won’t have the User and Client ID columns saved on their machine. We recommend moving this information to an encrypted JSL script before sharing the OAuth script.

Emphasis above is mine.

Based on that I do not believe we store passwords. What is stored are the tokens used by applications built using the OAuth framework in JSL.

@bryan_boone can provide more details here.

Jeff_Perkinson

Note to self: Never reply after bedtime. My apologies.

I located the section of the documentation you were referring to. It's the About Importing Google Sheets section:

•Information that Google uses to authenticate your account is stored in C:/Users/<user name>/AppData/Roaming/SAS/JMP/OAuthTokens.jmp. (Your Google password is encrypted.) This enables you to import and export data using the same Google account without providing the authentication information again. Note that a user with access to your computer’s user account has access to all of your Google spreadsheets. If they contain confidential information, reconsider sharing your user account.

The oauthtokens.jmp on a Mac is in ~/Library/Application Support/JMP.

Based on what's in my oauthtokens.jmp I still don't believe we are storing passwords, but @briancorcoran can help confirm.

NB: I added the Length[] column below to show that the password field is empty.

2021-03-01_21-16-56.017.png

briancorcoran

Thank you Jeff Perkinson, you are correct. We do not store passwords, but access tokens that may expire depending on the service you are using.

Brian

Jeff_Upton

Thanks, Jeff and Brian, for this info!

@Jeff_Perkinson hope I can bug you or a colleague with a follow up Q:

I had found the Mac location you mention but it is not showing an OAuthToken.jmp file. I can access my demo Google Sheet via JMP without credentials so I'm assuming a token exists but the file is not showing up where we expect...and I'm not having luck finding it via search either. This is in contrast to my Windows instance that shows the OAuthToken.jmp file.

Any thoughts here?

Screen Shot 2021-03-02 at 8.54.33 AM.png

Thanks again! Your answers are good/welcome anytime

- Jeff

Jeff_Perkinson

You're looking at /Library (the one for your whole machine). You need to be looking the Library in your Home folder (~/Library).

In the Finder hold the Option key down and click on the Go menu and choose Library.

I would like to give you a screen shot of the Go menu showing the Library choice but that's hard to do since the Option key gets in the way of the screenshot tool.

Instead here's the folder I'm talking about:

2021-03-02_13-45-28.455.png

Jeff_Perkinson

@sheila_loring, can you update the doc to remove the reference to stored passwords, or, even better, make clear that no passwords are stored?

sheila_loring

I've added the italicized portion to the doc:

Note that your Google password is encrypted and not stored on the computer.

briancorcoran

@sheila_loring That's not what Jeff said. It should really say: Passwords are not stored on the computer and access tokens are encrypted.

Jeff_Upton

Found it - thanks again for your help, Jeff!!