From: Alex Stahl <astahl@...5.com>
Date: 2010-09-04T08:56:38+09:00
Subject: Re: encrypt passwords

You could also store the user/pass off in a read-protected file
somewhere else on the fs, and read it in at runtime, depending on how
secure the box running the script is.

Then again, I have to agree with the concept that storing bank
credentials anywhere (encrypted or no) presents a security
vulnerability.

On Fri, 2010-09-03 at 18:32 -0500, Aaron Turner wrote:
> On Fri, Sep 3, 2010 at 4:20 PM, Junkone <junkone1@gmail.com> wrote:
> > hi
> > i have a ruby script screenscraping my bank. how can i encypt the
> > userid/password in the ruby so that even if someone steals my script,
> > they will not have access to my passwords.
> 
> The problem is of course your script will have to decrypt the password
> in order to use it.  So how does your script decrypt it in a way that
> someone who steals your script won't be able to.  If you give it some
> thought, you'll realize anything your script can do, so can your
> attacker.
> 
> You're probably better off running your script as a daemon and on
> startup prompting the user for the username/password and caching that
> in memory.  This isn't 100% secure either- anyone who is root or
> logged as you on your box can dump the memory and find the info, but
> it would solve your specific attack vector of someone stealing your
> code.
> 
> Personally, I'd never write code which does what you want to do (login
> to my bank's website without me entering the username/password each
> time)- too risky.
>