News for hackers. Stuff that matters.

A comment on Environment Variables Considered Harmful for Your Secrets. Parent comment

Re:Environment Variables Considered Harmful for Your Secrets by mreinsch on Friday January 02, 2015 @04:31AM (#8826177)
You're right that a tool which runs under the same user could read your config file and thus could access to your secrets.

But there is one main difference: that tool would need to do so explicitly, with the intent of reading (and possibly exposing) your secrets. For me, that's a huge difference from having the secrets being implicitly available to the process through the processes environment.

[ Parent | on HN ]
Re:Environment Variables Considered Harmful for Your Secrets by ealexhudson on Friday January 02, 2015 @05:38AM (#8826329)
It doesn't need to do so explicitly: it just needs to have a bug that can encourage it to do so. Most environment leakage also needs to be triggered too.
[ Parent | on HN ]