achristmascarl/rainfrog

Request: Secure way of specifying password

askvictor opened this issue · 4 comments

askvictor commented

description

The current way of specifying the credentials on the command line is insecure as it ends up in the command line history.

proposed solution

Allow typing password, or specifying via a file or environment variable

achristmascarl commented

thank you for the suggestion, that makes sense. in the meantime, for anyone else concerned about this, leaving some workarounds suggested by hackernews users:

Generally if you put a space before your command it'll bypass the history, though depending on your *nix you might need to set HISTCONTROL=ignoreboth in your bashrc or similar if it's not already.

source

Agree that it would be nice to specify credentials a different way - however as a workaround: some bash-based shells support prefixing the command with a space as a way of not saving that command into history.
Ref: https://www.gnu.org/software/bash/manual/html_node/Bash-Vari...

source

cs99alpha commented

Hello, if it's not too much trouble, could I please be considered for this issue?

achristmascarl commented

@cs99alpha unfortunately, the core terminal app needs some refactoring and tests before it's ready for other ppl to contribute. i appreciate the offer though!

  • 👍1
github-actions commented

Included in release v0.2.4