News for hackers. Stuff that matters.

A comment on Show HN: A password manager using Keybase for encryption and storage. Parent comment

Re:Show HN: A password manager using Keybase for encryption ... by woodruffw on Thursday June 08, 2017 @11:15PM (#14518937)
You're not missing something; I documented that under "Security Considerations" for `kbsecret login` [1].

`kbsecret login` provides the `-i` and `--interactive` flags for exactly this purpose. They should probably be the default, but the reasoning for the current form was making scripting easy.

    $ kbsecret new login gmail -i
    Username? *****
    Password? *********
(The asterisks don't actually show up, since tty echo is disabled for interactive input. This needs to be tweaked so that it's only disabled for sensitive inputs, but I haven't gotten around to that yet.)

[1]: https://yossarian.net/docs/kbsecret-man/kbsecret-new.1.html

[ Parent | on HN ]
Re:Show HN: A password manager using Keybase for encryption ... by minitech on Friday June 09, 2017 @03:54AM (#14519856)
That’s unsafe even for scripts; unprivileged processes can, by default, read the argv of any other process. (Try `sudo -u nobody cat /proc/$(pgrep -n kbsecret)/cmdline`.)
[ Parent | on HN ]
Re:Show HN: A password manager using Keybase for encryption ... by woodruffw on Friday June 09, 2017 @11:26AM (#14522052)
Hmm. My first reaction is that this isn't a huge issue, since each `kbsecret` invocation runs for a fraction of a second. However, that's unreasonable of me.

Do you know of any workaround for this? If it's unavoidable without requiring the user to change `/proc/`, then I'll probably have to get rid of argv input altogether.

[ Parent | on HN ]
Re:Show HN: A password manager using Keybase for encryption ... by minitech on Friday June 09, 2017 @12:30PM (#14522479)
There might be a workaround, but I think the common practice is to just avoid the problem with environment variables or by reading values from stdin.
[ Parent | on HN ]
Re:Show HN: A password manager using Keybase for encryption ... by Daviey on Friday June 09, 2017 @12:06AM (#14519106)
You could use $stdout.isatty as an indicator if it is a shell or interactive and make the default for each?
[ Parent | on HN ]
Re:Show HN: A password manager using Keybase for encryption ... by woodruffw on Friday June 09, 2017 @12:18AM (#14519146)
That sounds like a good solution, thanks!

Edit: I've created 0.4.1 for this change:

`kbsecret login` now performs interactive input by default, provided that `$stdin.tty?` is true and the -a/--args flag is not passed.

That provides both a more reasonable default and a way to override the safer behavior when testing for a TTY isn't a good enough indicator of noninteractivity.

[ Parent | on HN ]