Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Usage - Passing password in command line call #323

Open
8f0d4015198521d2c2b191eabf opened this issue Jul 8, 2021 · 3 comments
Open

Usage - Passing password in command line call #323

8f0d4015198521d2c2b191eabf opened this issue Jul 8, 2021 · 3 comments

Comments

@8f0d4015198521d2c2b191eabf

Why is in the demonstrated usage, the password is passed in the command line?

echo "pwd"|./argon2 saltsalt

The command (and password) is now visible by entering the history command in the terminal.

How can I use the executable without this problem? If I just enter ./argon2 saltsalt and then enter the password, the program halts.

I would expect the program to allow me to enter the password without echoing back to terminal.

@ufukty
Copy link

ufukty commented Jul 8, 2021

Is it good enough to be the example? It is not clear tho.

read -p "Enter password: " -s my_password
echo -n "$my_password" | ./argon2 saltsalt
unset my_password

And we can't use cat, it prints new-line at the end even if it is not in the file.

@8f0d4015198521d2c2b191eabf
Copy link
Author

I'm not sure, why not just read from the C program itself with echo disabled?

https://stackoverflow.com/a/59923166/6382242

@8f0d4015198521d2c2b191eabf
Copy link
Author

Setting the environment variable may allow it to be read by other processes on the system. Also, since Argon2 is meant to be slow, that environment variable will be set for a decent amount of time (plenty of time for another process to access it).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants