Kobo/Calibre password in the clear issue

[Cootey]

I realize that the Kobo beta web browser is a barebones thing and doesn't do popup windows, but as many people have discovered here who password protect their Calibre library, because of this, the Kobo browser never prompts for the username and password.

The best solution offered so far is to either disable authorization or use this URL:

http://username:password@myserver.com:8881/mobile

However, that puts my username and password in the clear for any wifi sniffer or network analyzer, never mind anybody picking up my Kobo and seeing the info in the URL field. Even if I'm mistaken about the security issues, is there a way to configure the Calibre server to offer a login page instead of a login popup window? If not, how do I go about requesting such a feature? Thanks.

~Dˢ

[DNSB]

Why are you running your home WiFi network without any encryption? Preferably WPA2/3. And perhaps a PIN code on your Kobo so it doesn't wake directly to the GUI.

[Cootey]

Originally Posted by DNSB

Why are you running your home WiFi network without any encryption? Preferably WPA2/3. And perhaps a PIN code on your Kobo so it doesn't wake directly to the GUI.

I am running encryption (WPA2), but I am referring to accessing my Calibre library from a public WiFi connection, such as at the Library or an office somewhere. For the most part, I run a hotspot off my iPhone and connect that way, especially when needing to do banking on my iPad, etc. but sometimes the Kobo doesn't connect well to my hotspot (It's a free feature, but weak). So I'll use a public WiFi connection. I'd rather not broadcast the URL with my username & password if I can avoid it.

As for using a PIN, that's an option, but also a pain, especially for home usage—which account for the majority of my usage. It would be more elegant if the Calibre server prompted for a name & password in a way the dumb Kobo browser could understand.

[kovidgoyal]

I'm afraid its not going to happen. The server is designed to work with non-browser based clients as wel, such as OPDS readers, which means it has to use http auth rather than html login forms. And note that if you use http rather than https login forms are no more secure than http auth. If you setup https then both are equally secure.

[Cootey]

Originally Posted by kovidgoyal

I'm afraid its not going to happen. The server is designed to work with non-browser based clients as wel, such as OPDS readers, which means it has to use http auth rather than html login forms. And note that if you use http rather than https login forms are no more secure than http auth. If you setup https then both are equally secure.

Thanks for the reply. I guess https is my best solution then.

Do I need to install OpenSSL into my Apache2 installation on my Mac, then point Calibre to the SSL certificate to enable https? Is there a tutorial online that can step me through some of those steps? Thanks.

~Dˢ

[kovidgoyal]

If you are puting the calibre server behind apache then setup https in apache. Otherwise, you will need the ssl certificate and private key in PEM format which you can specify to the calibre server for direct ssl support.