headers
Michael Witten | 28 Sep 2008 03:44
Picon
Favicon

Passwords

Hello,

I've noticed that many unix tools require that a user
specify account passwords in config files.

To me, this seems like a terrible idea, and indeed
msmtp at least prompts for a password when it needs
one.

However, what if I don't want msmtp to prompt me? For
instance, it seems reasonable to me that someone might
like to create a higher-level program that uses msmtp
to do the grunt work; in many cases, that higher-level
program might like to manage the password in its own
way.

Sure it's possible that this higher-level program
could provide that password via stdin, but that
seems like a flaky endeavor.

In short,

	Why are passwords dealt with in the way that
	they are?

	Is it dangerous to provide an option such as
	--password?

	Is it reasonable to use stdin?
(Continue reading)

Permalink | Reply | 2 comments |
headers
Martin Lambers | 28 Sep 2008 10:50
Picon

Re: Passwords

Hello Michael!

On Sat, 27. Sep 2008, 20:44:33 -0500, Michael Witten wrote:
> 	Is it dangerous to provide an option such as
> 	--password?

On multiuser systems: yes, because everyone else can look at your command
line, e.g. via ps or /proc/≤pid>/cmdline.

> 	Is it reasonable to use stdin?

Msmtp reads the mail from stdin, and it currently refuses to read a
password from stdin.

> 	Why are so many people willing to write their
> 	passwords in config files?

I guess because there are few alternatives.

The best thing to do is to store all of the passwords in a key ring that
encrypts and manages them.  When an application needs a password, it
asks the key ring, which then prompts the user for the master password
to the key database (if it has not already done so).

Unfortunately, key rings are not standardized and depend on the user's
desktop environment. Msmtp currently supports the Mac OS X and GNOME key
rings, but it would be nice to support more.

Does someone know of an abstraction layer for all the different key
rings that portable applications can easily use?
(Continue reading)

Permalink | Reply | 0 comments |
headers
Robert Thorsby | 28 Sep 2008 04:31
Picon
Favicon

Re: Passwords

On 28/09/08 11:44:33, Michael Witten wrote:
> I've noticed that many unix tools require that a user
> specify account passwords in config files.
> 
> To me, this seems like a terrible idea, and indeed
> msmtp at least prompts for a password when it needs
> one.
> 
> However, what if I don't want msmtp to prompt me? For
> instance, it seems reasonable to me that someone might
> like to create a higher-level program that uses msmtp
> to do the grunt work; in many cases, that higher-level
> program might like to manage the password in its own
> way.
> 
> Sure it's possible that this higher-level program
> could provide that password via stdin, but that
> seems like a flaky endeavor.
> 
> In short,
> 
> 	Why are passwords dealt with in the way that
> 	they are?
> 
> 	Is it dangerous to provide an option such as
> 	--password?
> 
> 	Is it reasonable to use stdin?
> 
> 	Why are so many people willing to write their
(Continue reading)

Permalink | Reply | 0 comments |

Gmane