4 ms·
To be fair, does linux/unix system also has similar thing? If the cmd tool supports passing the password as argument, it is supposed to be logged in whatever lo
by 772396 9y ago
To be fair, does linux/unix system also has similar thing? If the cmd tool supports passing the password as argument, it is supposed to be logged in whatever logging facility in the system. I am not aware of a feature to sanitize the password argument.
The usual way is the cmd tool supports supplying password as password prompt, and the user should always supply the password in the prompt except testing purpose.
So, I think it is more like a UI problem then a vulnerability.
- Johnny555 9y agoSo, I think it is more like a UI problem then a vulnerability It's both, it's a vulnerability in how the UI calls the CLI command. Passing the password on the command line is bad for a number of reasons, not just because it can end up in a log file.
- walrus01 9y agoI could be wrong but I do not think dm-crypt supports CLI passing of the passphrase. It uses interactive prompt only. https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_...