From: Dana Merrick <dmerrick@...>
Date: 2008-07-01T02:27:09+09:00
Subject: Hiding a password in code.

--------------enigE924DF1BCBF19A1AC2DDEFB7
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable

Hello!

The other day I wrote a small Ruby app to check my finances on Mint.com. =
My=20
intentions were to have this script run every once and a while and displa=
y the=20
information on my desktop (via a tool like Conky or GeekTool).

My problem is, how do I handle my password? Here are the two situations I=
've=20
considered:

1) Use the command line to enter the password.
2) Have the password stored in the script via some sort of encryption.

Neither of these seem very secure. In the first option, someone can sniff=
 my=20
password via the "ps" utility, and in the second, someone could view the =
source=20
code and figure it out.

Security isn't a HUGE priority, as this account doesn't really have acces=
s to=20
anything serious. Right now, I have the password in the file, encrypted w=
ith=20
ROT13 (hah!), just to make it a little harder for someone skimming the so=
urce to=20
figure it out.

Any ideas on how to handle this situation?

-Dana


--=20
Dana Merrick - System Administrator
Integrated Computer Solutions, Inc.
54B Middlesex Tpke, Bedford, MA 01730
617.621.0060 x112 - http://www.ics.com


--------------enigE924DF1BCBF19A1AC2DDEFB7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)

iEYEARECAAYFAkhpGBIACgkQ7b+8UB5G/wOWfwCfemjdGJLmlzM0Aja5pevdZh0f
7x0An1wtfXhlksVR1XgbZW/NNkvUzEME
=w6/A
-----END PGP SIGNATURE-----

--------------enigE924DF1BCBF19A1AC2DDEFB7--