Is it secure to store connection password on Pentaho Spoon?

Question

I'm gonna use Spoon to transfer data from Postgres to MSSQL. I see that when we create connection its data is stored and we don't need to type password anymore.

But I can't find where it stores this data. I looked on ktr file and didn't find username on it.

I searched how it's stored but found no info. I can't approve its use without knowing that the password is securely stored and a hacker won't retrieve it.

Update: I found on the ktr XML file where login is saved, and password is saved encrypted. Is it secure?

I didn't see a private key being used to encrypt it. If it's using some synchronous key encryption, isn't anybody able to decrypt it? It may be even worse to have an encryption that's easy to decrypt than no encryption at all.

Answer 1

The encryption used by Spoon for passwords is not secure.

You can use a User Defined Java Expression step in a Pentaho transformation to decrypt it:

New field: decrypted_password

Java expression: import org.pentaho.di.core.encryption.Encr;Encr.decryptPassword(encrypted_password)

Value type: String