winbox.cfg saves plain text passwords !
Why does not it save MD5 or SHA1 password, and not to use plan text authentification when sending password (even with secure connection).
Just simply store and authentificate with MD5 or SHA1 hashed password, like many others programs.
IMO this is a feature not a problem. It’s useful when there’s a need to recall a password.
I don’t let anyone touch my laptop, and it is BitLocker’d so I DON’T REALLY CARE about this. And so should you.
winbox.exe takes three optional parameters/arguments:
winbox [location [username [password]]]
e.g.
winbox firewall.business.com admin mysecret
So you could get around both of the problems mentioned here (security - lack of encryption of winbox.cfg file and structure - folders per site/user/whatever) by writing your own wrapper for Winbox which stores passwords securely and allows you to organise the data howsoever you wish.
Alternatively, you could just create a whole load of Windows shortcuts organised however you like and (optionally) stored in an encrypted filesystem.
Or you could use something like http://keepass.info/ as your wrapper and have it automatically launch Winbox with the correct parameters.
Just my 2p.
Nick.
isn’t it possible to obtain command line parameters of any user’s process in system? =)
It would be nice if winbox could register protocol like that:
winbox://login:password@address
or at least parse
winbox winbox://login:password@address
hmm but what is this then?
winbox.exe 10.1.10.1 admin mysecret
Yup. I was hoping that Winbox would do something sensible in this regard (spawn child, kill parent?), but I haven’t tested it and I suspect that my optimism is unplaced!
Nick.
well, the second is command-line. the first is URL Handler. from the webbrowser you can only run URL =)
I know, but what did he mean by “parse”. what do you need URL handlers for, is there a lot of situations where you want to call winbox from within a webpage? not to mention storing password in that webpage in plain sight 
it simply means cutting of ‘winbox://’ from command line and replacing of %20 with space, so one can use winbox://address%20user%20password URL to run WinBox =)
p.s. https is not so plain, and browser’s cache is not less secure than winbox.cfg with plaintext passwords =)
sorry, but all this looks like reinventing the wheel:
at first:
Q:we need something better than winbox
A:use DUDE
then:
Q: we do not want to use DUDE, because it is “pinging” around
A: turn that off
Q: what else i can use, i do not want to use DUDE, you should improve winbox
A: DUDE is feature rich tool that can replace winbox.
if you look at dude as a winbox replacement - you can simply add devices, turn all probes down, assign routers in groups, manage upgrades of those groups etc. It is feature rich power-tool.
IMHO winbox is screwdriver while DUDE is kitted out robotic arm.
yesss, I like to go shopping on my ‘M1 brams’ tank =)
point is - no one is going to improve “screwdriver” while you can strip your “tank” to bare minimum if features you need and do what you want to do. After some time, you will notice, that you are using more and more features of The DUDE and it will seem impossible - how you did without it.
It is really easy to use and really addictive configuring several routers at time - a breathe.
That path leads to bloat. Sometimes it is better/easier/faster to have the screwdriver.
Correct me if I’m wrong, but doesn’t The Dude just start up winbox for you anyway? If so, then what you’re proposing is an additional layer which seems somewhat redundant to me.
Also, and again correct me if I’m wrong, don’t I have to install The Dude? Winbox runs as a standalone executable which means I can run it on any machine anywhere without any hassle.
Nick.
okey I’ll do that by myself ;p
Janisk I appreciate your opinion, however the whole thing started with a tiny feature request for a “find” textbox in Winbox 
That simple thing would ease management of even thousands of sessions… If I would be able to just filter them by name or IP, I wouldn’t in most cases need DUDE. I like DUDE and I use it in some places, where history and alerts matter, but for everyday use, to just login and manage routers I prefer Winbox for now…
I can bet that many of us, your users, share my opinion
Have a nice day.
No, wait! Do you use Winbox on server where dozens of potential attackers are logged at the same time and do nothing but sniff command line parameters??? No, you use it exclusively on your PC where no-one can log on, and if she can, she is unable to do what you described. Why you need such excess security measures? Aren’t you able to just secure yourself?..
chojrak11, in that case plaintext passwords in text file are not prolem too =)
I never said it is a problem, TrueCrypt / BitLocker helps to not care about such details
will they help to allow WinBox to acces his config and block other programs from accessing it?