From: Robert Klemme <shortcutter@...>
Date: 2008-07-01T20:47:44+09:00
Subject: Re: Hiding a password in code.

2008/6/30 Michael Morin <uzimonkey@gmail.com>:
> Store your password in an encrypted file.  When you start the script up,
> enter the encryption password to decrypt the file so your Ruby script can
> grab it and keep it in memory.  It won't be stored in plaintext in the file
> (but will probably end up in swap if you're really paranoid).

Frankly, I'd rather let the user enter the password.  The security is
the same, usage convenience is as bad as in your suggestion but
implementation becomes much easier.

> This is about as effective as entering the password as the script starts
> come to think of it.  This has always been a problem.  You can't store the
> password to be retrieved automatically, the best you can do it obfuscate it.
>  And you're right, never give passwords on the command-line.  Scripts that
> need passwords should read them from keyboard or STDIN.  Especially if
> you're on a shared machine.

Alternatively, *if* you trust file system permissions or have
automatic file system level encryption you can store it in plaintext.
:-)

Kind regards

robert


-- 
use.inject do |as, often| as.you_can - without end