News for hackers. Stuff that matters.

A comment on Show HN: HiSHtory: Your shell history in context, synced, and queryable. Parent comment

Re:Show HN: HiSHtory: Your shell history in context, synced,... by ilyt on Wednesday November 02, 2022 @09:34AM (#33435500)
Some apps only accept password in commandline.

The better written ones might accept it in env but that will also stay in history.

But if someone have access to your home they can put keylogger in the .profile/.bashrc so it's not really relevant...

[ Parent | on HN ]
Re:Show HN: HiSHtory: Your shell history in context, synced,... by ellieh on Wednesday November 02, 2022 @10:21AM (#33436241)
Sure, but something like this also works well:

`the-command --password $(read -s;echo $REPLY)`

[ Parent | on HN ]
Re:Show HN: HiSHtory: Your shell history in context, synced,... by ilyt on Thursday November 03, 2022 @10:19AM (#33451403)
yeah now instead of history you can get the app's password via `ps aux` :D

also you still have the `export REPLY=password` in history.

sure you can source it out of file but, well, that file have same permissions (or looser! if you forgot to change) as your .bash_history file.

`cat password|command` is the safest one (or, well, something 12 factor app clowns hate, a config file)

[ Parent | on HN ]