0

I use the pass password manager on linux. I can use it to script shell commands that involve credentials without those creds showing up in my command-line history, e.g.

foo-cli --password=$(pass show foo)

The actual password won't show up in command-line history, but it will show up in a process analyzer like ps, if one happens to be running at the same time the command is executed.

ps a | grep foo-cli
14099 pts/3    S+     0:00 foo-cli my-cleartext-password

How exploitable is this? Should I consider such scripting totally unsafe even on a personal machine? Are there known attacks involving someone listening/analyzing processes?

ivan
  • 163
  • 5
  • How exploitable it is depends on your threat model. Yes, scripting that exposes sensitive data in `argv` is unsafe if you do not trust every other process running as any user. And yes, there are known attacks that involve information leakage in `/proc`. – forest Jun 26 '18 at 13:14
  • Commands that take passwords as CLI arguments are bad form anyway. Using environment or stdin or a temporary descriptor are better if you have to do this at all. – Joe Jun 27 '18 at 14:29

0 Answers0