Credentials Management in Projects, Insert-to-Code, and Project-lib

The Watson Studio Notebook user interface allows you to insert code snippets and credentials for data connections and data assets into your notebook code.

The problem is that it puts usernames and passwords in cleartext into the code even if you had no other way of retrieving or knowing the credentials.

Example 1: Watson Studio sets up a Service ID with access privileges to Cloud Object Storage. In most interactions with Watson Studio / Watson Knowledge Catalog you will never see those credentials since they are used in the background completely transparent to the end user. Access to Watson Studio / Watson Knowledge Catalog is granted to the individual personal user id (e.g. Bob). As soon as Bob has access to Watson Studio with notebooks activated Bob can retrieve username and password of the service ID of Watson Studio used for Cloud Object Storage and Bob can use those credentials to access the data in Cloud Object Storage from everywhere in the world until the service id credentials are revoked or reset.

Example 2: When you create a connection to a DB2 database in Watson Studio it stores the username and password and the connection is automatically shared with all collaborators in the project. Let's say Alice sets up access to data source X and creates the data connection with her intranet credentials. Bob is a collaborator in the same project. Bob can now create a Watson Studio Project and insert the credentials of Alice in cleartext in his notebook and can impersonate Alice against every w3id enabled application until Alice's w3id is revoked or reset.