Re: hiding passwords

I have never tried this myself, but I think it would work:

Obtain unencrypted password.

Set umask to 777 (backup original umask)

Open/create ".mypassword" (clobber existing file)

Delete ".mypassword".

Restore umask.

Write unencypted password to file.

Trash the memory resident copy of the password.

Whenever the password is needed, a seek() and read() can be performed to obtain it. Do *not* close the file descriptor until it is known the password is never required again.

No other user can open this file since it has no read or write permissions. Secondly, it will only exist on the file system for an extremely short period of time. If it were created in a directory with excessively restricted permissions then only root would ever be able to get to it.

If your program dumps core, the .mypassword file will not be available since it has already been unlinked. Not until the last file descriptor is closed will the space be reclaimed. As far as I know, this is true of all unix file systems, not sure how it works with Windows. If you are concerned about core dumps, then I think Windows is irrelevant.

For the majority of the runtime, all the core dump will contain is evidence of a file descriptor, which gives away zero information.

For the remainder of the runtime, there is a slight chance a core dump might contain the password. This could be eliminated if the authentication mechanism allowed for passwords to be sent byte at a time, but I have never seen such a system.

Alternatively, rotating the passwords might avoid this problem too.

-Frank

Comment on Re: hiding passwords

Replies are listed 'Best First'.
Re^2: hiding passwords by 5mi11er (Deacon) on Jun 15, 2005 at 14:53 UTC
Wow, this sounds really convoluted, but might work... But this seems to be largely a waste of time and effort, because, as lots of people are trying to tell you above, the problem is "where is the weakest part of the security"? It's not the system, or it's memory. It's on the network itself. A sniffer can easily capture a clear text password. Until clear text passwords are done away with, the scripts' system's memory is (very likely) not worth worrying about. OP, there are lots of guesses going on above about why you are worrying about a core dump scenario, could you enlighten us as to your actual reasons? -Scott	[reply]

Replies are listed 'Best First'.

Re^2: hiding passwords
by 5mi11er (Deacon) on Jun 15, 2005 at 14:53 UTC

But this seems to be largely a waste of time and effort, because, as lots of people are trying to tell you above, the problem is "where is the weakest part of the security"? It's not the system, or it's memory. It's on the network itself. A sniffer can easily capture a clear text password. Until clear text passwords are done away with, the scripts' system's memory is (very likely) not worth worrying about.

OP, there are lots of guesses going on above about why you are worrying about a core dump scenario, could you enlighten us as to your actual reasons?

-Scott

[reply]