I can't see ANY reason why overwriting the value in a scalar with the same number of bytes should EVER change to the situation where Perl is reallocating memory and doing a copy every time. This would be inefficient and is completely unnecessary.
Just because you and I can't see a reason why it should copy doesn't mean it will not. I can't see a reason why sendmail should overflow buffers, and I don't think the author(s) ever had any intentions it should. But it has happened in the past, and I won't guarantee it will not happen again in the future.

Requirements may change. Ideas may change. Design principles may change. Mistakes may happen. Basing security on "that would be illogical" may work on Vulcan, but not here.

As noted before physically securing the box is to my mind far more important. Just look at the banks for example. How many root kits are there that let you escalate user level privilege to root whereby you can just read the script/config without having to go to the extent of trawling through memory?
Wearing safety belts in a car is more important than having a fire extinguisher in a car. But that doesn't mean that if you decide to buy a fire extinguisher it's unimportant how well it works, and how to mount it in your car.

Furthermore, there are cases where it is important to protect yourself from people with root permission that you can't or won't trust. PGP for instance. Sure, it is possible for someone to replace a kernel to do whatever they want to do, but that is far more difficult than trawling /dev/kmem.

Abigail

In reply to Re: Handling encryption safely by Abigail-II
in thread Handling encryption safely by bagu

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.