I use the pass password manager on linux. I can use it to script shell commands that involve credentials without those creds showing up in my command-line history, e.g.
foo-cli --password=$(pass show foo)
The actual password won't show up in command-line history, but it will show up in a process analyzer like ps
, if one happens to be running at the same time the command is executed.
ps a | grep foo-cli
14099 pts/3 S+ 0:00 foo-cli my-cleartext-password
How exploitable is this? Should I consider such scripting totally unsafe even on a personal machine? Are there known attacks involving someone listening/analyzing processes?