4 ms·
Another problem with simplecrypt is the password is exposed in plain text to any other process. http://www.gnupg.org/faq/GnuPG-FAQ.html#why-do-i-get-gpg_warnin
by illumen 13y ago
Another problem with simplecrypt is the password is exposed in plain text to any other process.
http://www.gnupg.org/faq/GnuPG-FAQ.html#why-do-i-get-gpg_warning_using_insecure_memory http://www.gnupg.org/faq/GnuPG-FAQ.html#why-do-i-get-gpg_war...
Also the source code looks like encrypted text. I can't figure out what much of it does, or why it does it by reading it.
Also, I think the API is not the best, because it asks for a password. Where are people storing the password? This promotes easy mistakes... like for example, saving it to a file, or reading it from a web input form.
- andrewcooke 13y agoi don't know a good way to avoid the in-memory password from within python - if that is possible, please show me how and i'll fix the code. the larger point about passwords is, i think, part of the reason for keyczar's approach. but that is not yet available in python 3 (certainly not when i wrote the code; i did check since and last time i looked there was a patch being considered). however, i was quite proud of the source - https://github.com/andrewcooke/simple-crypt/blob/master/src/simplecrypt/__init__.py https://github.com/andrewcooke/simple-crypt/blob/master/src/... edit: i've added some warnings to the project page - https://github.com/andrewcooke/simple-crypt#warnings https://github.com/andrewcooke/simple-crypt#warnings