Security: Service passwords stored in plaintext in the settings file

[ea4k]

Problem

Passwords for all integrated online services are written verbatim to KLog's INI-format settings file:

src/setuppages/setuppageelog.cpp:636-662:

settings.setValue ("ClubLogPass", clubLogPasswordLineEdit->text());
settings.setValue ("ClubLogAppPass", clubLogAppPasswordLineEdit->text());
settings.setValue ("eQSLPass", eQSLPasswordLineEdit->text());
settings.setValue ("QRZcomPass", QRZCOMPasswordLineEdit->text());
settings.setValue ("LoTWPass", lotwPasswordLineEdit->text());

The settings use QSettings::IniFormat (src/utilities.cpp:544), i.e., a plaintext file in the user's config directory.

Impact

Anything able to read the user's config directory (other local users on a shared machine, backup tooling, malware, accidentally shared config in a bug report) obtains the user's ClubLog, eQSL.cc, QRZ.com, and LoTW credentials in one file. Users frequently reuse passwords, so the blast radius can extend beyond ham-radio services.

Proposed fix

• Preferred: store credentials in the OS keyring via QtKeychain (works on Linux/macOS/Windows; already packaged in major distros).
• Minimum: at least obfuscate at rest, restrict file permissions, and document the risk; warn users not to attach their config file to bug reports.
• Make sure passwords are never written to debug logs.