2 ms·
Via either program config files, an inline subshell calling cat, or ssh-agent in that specific case, to keep credentials both out of the environment, and off of
by LanternLight83 6y ago
Via either program config files, an inline subshell calling cat, or ssh-agent in that specific case, to keep credentials both out of the environment, and off of the command-line where it can be read by inspecting the resulting process for it's invocation.
- emj 6y agoYou can disable access the possibility to read the memory of other processes and you can do it for environment variables. Storing access tokens in memory is more obscure than environment variables, that is true though.
- 0xEFF 6y agoAll of those places can also be read. SSH agent is a good example. It’s effectively an environment var which is why this works fine: sudo SSH_AUTH_SOCK=$SSH_AUTH_SOCK git clone ... Edit: The reason I think it’s silly to make a blanket statement environment vars are bad is because too many containers have credentials baked into the image when they should be passed in another way.