3 ms·
Re Python netrc bug, you shouldn't put valuable passwords in ~/.netrc: http://jwilk.net/blog/20131104-netrc-security http://jwilk.net/blog/20131104-netrc-secur
by jwilk 9y ago
Re Python netrc bug, you shouldn't put valuable passwords in ~/.netrc:
http://jwilk.net/blog/20131104-netrc-security http://jwilk.net/blog/20131104-netrc-security
- phyzome 9y agoSure, there are a lot of reasons not to use netrc for valuable passwords, starting with "don't put valuable passwords in plaintext especially in a predictable location"! I use it quite sparingly. At work, sometimes I need to make a large number of calls to a password-authenticated API. My approach there is to `sudo mount -t tmpfs -o size=5M tmpfs ~/tmp/secret/`, put a .netrc in there, and use curl's `--netrc-file` option to point to it. When I'm done, I umount the ramdisk. The password never hits the disk unencrypted, modulo swap.
- jwilk 9y agoYou could make curl read netrc from a pipe. Something like this should work: #!/bin/bash password=$(...) # replace with code to extract password from the the password manager generate_netrc() { printf 'machine www.example.org login foo password "%s"\n' "$password" } curl -v --netrc-file <(generate_netrc) http://www.example.org No need for sudo and no risk of hitting swap. :-)
- emmelaich 9y agoper my comment above, you can put arbitrary stuff in account field (e.g. encrypted) passwords. Works fine if you write the code that uses it.