From: Aaron Turner Date: 2010-09-04T08:32:11+09:00 Subject: Re: encrypt passwords On Fri, Sep 3, 2010 at 4:20 PM, Junkone wrote: > hi > i have a ruby script screenscraping my bank. how can i encypt the > userid/password in the ruby so that even if someone steals my script, > they will not have access to my passwords. The problem is of course your script will have to decrypt the password in order to use it. So how does your script decrypt it in a way that someone who steals your script won't be able to. If you give it some thought, you'll realize anything your script can do, so can your attacker. You're probably better off running your script as a daemon and on startup prompting the user for the username/password and caching that in memory. This isn't 100% secure either- anyone who is root or logged as you on your box can dump the memory and find the info, but it would solve your specific attack vector of someone stealing your code. Personally, I'd never write code which does what you want to do (login to my bank's website without me entering the username/password each time)- too risky. -- Aaron Turner http://synfin.net/         Twitter: @synfinatic http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.     -- Benjamin Franklin "carpe diem quam minimum credula postero"