Don't Show Password in RDP Tab

Feature Requests Royal TSX (for macOS)
1

If Royal TSX is opened using a rtsx:// url with an (URL-encoded) embedded rdp:// that includes a password (as most rdp:// urls would), that password can be easily seen just by clicking on the tab and copy+paste.

In fact, it’s easy enough to drive by someone else’s machine and just click on it to see their password.

While one option is “don’t use Royal TSX this way”, a better option would be to simply mask the password before putting the URL in the tab.

NOTE: I know some organizations would consider this a security issue, but I was recommended to publish this here. I hope that’s alright.

2

Just to clarify: By “Tab” you actually mean it shows up in the ad hoc computer name field in the toolbar, right?

Thx,
Felix

3

So from here…

image
image1336×434 47.3 KB

4

Hi James,

thx for the screenshot. I was worried that the whole connection string would show up in the tab title after your initial description. Thankfully it does only show up in the ad hoc computer name field which is by design at the moment.

For the next update, we’ll not put the connection string into that box however if you pass it via the “rtsx://” URL scheme. So that should fix your issue.

cheers,

Felix