Pinboard Password Problem

[Jim Leff]

Hi!

First, thanks for Cloudmarks. It's great!!

So today I changed my Pinboard password, per Heartbleed clean-up. 

Of course, Cloudmarks needed to be updated, as well. So I went to Keychain Access and deleted  “api.pinboard.in", quit Safari, and relaunched.

I entered my Pinboard user name and my Pinboard API token, and....nothing. Cloudmarks keeps showing "401 forbidden".

Help?

[Canisbos Computing]

Hi,

Thanks for the note. There were some bugs in Cloudmarks 2.2, which was released yesterday and which your computer must have auto-updated to before you deleted your Pinboard password in the keychain.

I've just released Cloudmarks 2.2.1, which should fix the bugs. You can either let Safari update for you or download the extension again from https://dl.dropboxusercontent.com/u/23990/Canisbos/Cloudmarks.safariextz.

Sorry for the trouble.

Regards,

Chul

--

---
You received this message because you are subscribed to the Google Groups "Canisbos Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to canisbos+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Jim Leff]

Chul, I've updated to 2.2.1, but it's still not working.

My Pinboard API token is in this format: [My username]:[Long string of numbers]

I've tried entering both of the following into Cloudmarks:

Name: [My username]

Password: [Long string of numbers]

...and:

Name: [My username]

Password: [My username]:[Long string of numbers]

Both yield 401 errors. If you have a Pinboard account, I'd guess it would be easy to test (note that I'm NOT entering my Pinboard password, I'm posting the API Token available in the "my settings" page.

[Canisbos Computing]

Jim,

You have to enter your username and password. These are not stored by Cloudmarks, but by the OS X keychain. Cloudmarks has no access to your password, so fret not.

Chul

[Jim Leff]

From the Pinboard developer:

Remember never to share your Pinboard password with any third party, no matter how nicely they ask. Outside sites should be able to get all the access they need using only the API token.

[Canisbos Computing]

You are not providing your Pinboard password to Cloudmarks.

When you log in to http://pinboard.in in your browser, you do provide your password to Safari, right? It's the same when you log in to https://api.pinboard.in. Cloudmarks is causing Safari to log in to that server, but Safari is the program that is actually performing the login. My extension knows nothing of the login process and doesn't know how to log in. It has NO access to your password; it simply can't see it.

Chul

[Canisbos Computing]

Furthermore, Cloudmarks is not a site. It is a browser extension. The advice to never provide your password to a site does not apply.

Chul

[Jim Leff]

Makes sense to me. Thanks, Chul. And thanks again for Cloudmarks.

[Canisbos Computing]

You're welcome!

Chul

On Apr 12, 2014, at 6:21 PM, Canisbos Computing <cani...@gmail.com> wrote:

[Jim Leff]

FWIW, the Pinboard dev replies:

I think it’s fine if the service is not storing your Pinboard credentials on a remote server, but on your own machine. My wrath is reserved for sites that request and then store your password on a third-party computer. 

[Canisbos Computing]

Right...especially since it's not Cloudmarks that is storing the credentials, but OS X itself, and Cloudmarks can't get at them even if it wanted to.

Chul

On Apr 12, 2014, at 6:33 PM, Jim Leff <jimle...@gmail.com> wrote:

FWIW, the Pinboard dev replies:

I think it’s fine if the service is not storing your Pinboard credentials on a remote server, but on your own machine. My wrath is reserved for sites that request and then store your password on a third-party computer.