From: Junkone Date: 2010-09-04T08:45:10+09:00 Subject: Re: encrypt passwords On Sep 3, 7:32 pm, Aaron Turner wrote: > On Fri, Sep 3, 2010 at 4:20 PM, Junkone wrote: > > hi > > i have a ruby script screenscraping my bank. how can i encypt the > > userid/password in the ruby so that even if someone steals my script, > > they will not have access to my passwords. > > The problem is of course your script will have to decrypt the password > in order to use it.  So how does your script decrypt it in a way that > someone who steals your script won't be able to.  If you give it some > thought, you'll realize anything your script can do, so can your > attacker. > > You're probably better off running your script as a daemon and on > startup prompting the user for the username/password and caching that > in memory.  This isn't 100% secure either- anyone who is root or > logged as you on your box can dump the memory and find the info, but > it would solve your specific attack vector of someone stealing your > code. > > Personally, I'd never write code which does what you want to do (login > to my bank's website without me entering the username/password each > time)- too risky. > > -- > Aaron Turnerhttp://synfin.net/        Twitter: @synfinatichttp://tcpreplay.synfin.net/- Pcap editing and replay tools for Unix & Windows > Those who would give up essential Liberty, to purchase a little temporary > Safety, deserve neither Liberty nor Safety. >     -- Benjamin Franklin > "carpe diem quam minimum credula postero" how about one way hashes or digital keys which is based on my machine. i just read this stuff on internet and dont know how to use or create them. looking for ideas.