From: Leslie Viljoen <leslieviljoen@...>
Date: 2008-07-01T04:13:20+09:00
Subject: Re: Hiding a password in code.

On 6/30/08, Dana Merrick <dmerrick@ics.com> wrote:
> Michael Morin wrote:
>
> > Store your password in an encrypted file.  When you start the script up,
> enter the encryption password to decrypt the file so your Ruby script can
> grab it and keep it in memory.  It won't be stored in plaintext in the file
> (but will probably end up in swap if you're really paranoid).
> >
> > This is about as effective as entering the password as the script starts
> come to think of it.  This has always been a problem.  You can't store the
> password to be retrieved automatically, the best you can do it obfuscate it.
>  And you're right, never give passwords on the command-line.  Scripts that
> need passwords should read them from keyboard or STDIN.  Especially if
> you're on a shared machine.
> >
>
>  These are excellent points. The reason I haven't done this is that I'd like
> to have my script be able to run without action from me, in the background.
>
>  I suppose I just need to accept the fact that I'm asking to do something
> inherently insecure in an interpreted language. I'm pleased enough with this
> solution:
>
>  form['password'] = @options[:pass] ||
> "AvprGel".tr("A-Za-z","N-ZA-Mn-za-m")

"Interpreted language" is pretty much irrelevant though. The hackers
that be can pull hardcoded passwords out of compiled code very quickly
and easily.

Gnome solves this situation by using the Gnome login to open an
encrypted keyring which stores passwords to things like Wireless
networks. There should be a way for a Ruby program to leverage this
functionality.

Les