I know this subject has already been discussed a bit.
Still, I did see mentionned the ng server password, but I would stress out the email password that is also in plaintext AND that is in my opinion WAY more sensitive and would IMHO urge more for an action on this topic.
As a reminder, Gmail for example does require authentication for smtp, thus your full email account could get compromised.
Any user/app/script having access to the user session is able to pick those passwords way too easily.
I know that encryption is not that easy: if the program can unencrypt so does a dedicated guy who has access to the source code (as sabnzbd is open source).
Even then, I still think that obfuscation of the password is the way to go, as it can prevent 98% (give or take
) of usual ways to get it (as 2% have the knowledge & time to go through all the pain to pin point the way sabnzbd does it).Moreover, I can think of ways to link the encryption to things/settings on the computer hosting sabnzbd (to obfuscate it a little bit more, still not a perfect solution either). If those uncommon things get changed, the unencryption will fail to produce the proper password, authentication will fail, and you can then re-ask the user the password(s) (should'nt happen too often that way).
I hope you consider even basic obfuscation, despite not being perfect, as a good way to drastically reduce the population of people who can so easily get that sensitive info.
Thanks for your hard work & dedication to make sabnzbd the best ng client out there!
