News:

On Tuesday September 6th the forum will be down for maintenance from 9:30 PM to 11:59 PM PDT

Main Menu

where (and how) is my google password stored

Started by suddenly_unambitious, May 09, 2017, 02:53:51 PM

Previous topic - Next topic

suddenly_unambitious

An obihai could be a very useful addition to my house, but I have a question before I buy.

I am looking at the obihai202.  I understand the product needs a username/password (or possibly an api key) entered as part of the setup (presumably to be saved for subsequent logins). 

What I want to know is where (and how) is it saved?  It is saved locally on my obihai202?  Or is it saved on the obitalk account website somewhere?  Both?  If it is saved  on the website then I expect it is recorded in plain text (otherwise the device can't perform a login when it powers on).  It could just be the hashed value if it was saved on the obihai202, but plain text seems likely here too..

My google account as it has a lot of information that is important to me and how the password is handled will determine if obihai is right for me.

Cheers

SU

SteveInWA

Hi:

Your Google account password is not stored at all, anywhere -- not on the OBi device, and not on the OBiTALK web portal.

During setup of a Google Voice number on an OBi device, you will first log into your desired Google/Gmail/Google Voice account on a computer's web browser.  Leaving that tab open and logged in, you'l then open a new browser tab (Ctrl-T) and then log into the OBiTALK web portal in that second tab.  You will then click on the desired Service Provider slot (SP1--SP4 on a 202), and you'll be prompted through the Google Voice setup procedure.

During the procedure, OBiTALK will kick off an OAUTH 2.0 secure (encrypted) token exchange with your Google account.  It will ask you to confirm that you are logged into the correct Google account (in the other tab), and then it will take you to your Google account permission page, where Google (not Obihai) will ask for your approval to grant OBiTALK access to the Chat service on your Google account.  After that, the token exchange will take place.  At no time is your password ever exposed.  All you are granting the OBi device is access to the one specific service on your Google account.  There is no way to reverse engineer nor sign into anything else on your Google account, as a result of the token exchange.  At any point in the future, you have full control over revoking that permission if you wish, on your Google account management page.

suddenly_unambitious

Thanks for the reply Steve.  The credential handling is significantly better than I was expecting.  I dare say it is actually optimal.

I think I'll buy one and give it a try.

Cheers

SU

SteveInWA

Glad to help.

If you are only going to use the one Google Voice account with your OBi, the OBi 200 will suffice, at a lower purchase price.  If you need two different physical telephone ports, e.g. for two different service providers, then get the 202.

Lavarock7

Whenever I buy a device for a neighbor or recommend one, I suggest the 202 over the 200. You may not need or want a second phone line now, but after playing with the unit for a while, that may change.

For example, I have an old X-10 device (answers the phone and allows me to punch in touch tones to control lights). I can have that on line 2. Even if I don't want to assign a second DID (inbound number) for the X-10, I can still access it from an automated attendant or as an extension. I use Voip.Ms for my extensions but many of the Voip providers do the same.

A second line could be used for a fax machine (although fax can be a bit flaky through any kind of Voip) or even separating business and home calls.
My websites: Kona Coffee: http://itskona.com and Web Hosting: http://planetaloha.info<br />A simplified Voip explanation: http://voip.planet-aloha.com