Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

Re:Logs in High Sierra Show Plaintext Password for APFS Encr... by tinus_hn on Tuesday March 27, 2018 @06:19AM (#16686920)

If you run the ps command you can see all processes with all the command line arguments. They’re not secret, which is why you shouldn’t put passwords there.

Now typically these processes only run for a short time so it’s difficult to catch passwords manually but it’s predictable so a script can.

[ Parent | on HN ]

Re:Logs in High Sierra Show Plaintext Password for APFS Encr... by your-nanny on Tuesday March 27, 2018 @09:24AM (#16688040)

So what is the proper way?

[ Parent | on HN ]

Re:Logs in High Sierra Show Plaintext Password for APFS Encr... by tinus_hn on Tuesday March 27, 2018 @09:37AM (#16688171)

Either store them in environment variables or pass them through file descriptors, such as standard input.

Note that you do need to take care to clean up the environment if you create new, unprivileged subprocesses or these secrets may leak.

[ Parent | on HN ]

Re:Logs in High Sierra Show Plaintext Password for APFS Encr... by your-nanny on Tuesday March 27, 2018 @06:57PM (#16693592)

Thanks.

[ Parent | on HN ]