5 ms·

Rot13 is actually useful. I have perl scripts which download my bank statements, running from cron. Gets the latest every month. These perl scripts use password

Rot13 is actually useful. I have perl scripts which download my bank statements, running from cron. Gets the latest every month. These perl scripts use passwords, but without knowing that they are there, who would find them? The trouble is, they have to pass the name of the form field to the server on the other side, which is some variation of "password". So anyone doing a simple string search will eventually find the perl scripts, and have access to my passwords (supposing they have root). If I rot13 the form field name, and then have the name be rot13('cnffjbeq') in the script, this makes is unsearchable.

kemayo 12y ago
Note to self: add "cnffjbeq" to my password-finder scripts.
- NoMoreNicksLeft 12y ago
  Might as well add rot-1 through rot-25 to it as well... not like there's a storage constraint, is there?
kedean 12y ago
That's pretty heavy security through obscurity. A more robust solution would be to have all of those passwords encrypted with a master key. You can make the script prompt you for the master key when you start it up, then it runs without needed any more input, but you aren't storing sensitive information.
- NoMoreNicksLeft 12y ago
  Yes. A master key. Which would have to be included in the perl script... so that when they find the script, they have all my passwords instead of just a few. You've solved it. Why didn't I think of that? > You can make the script prompt you for the master key when you start it up, Why the fuck would I want to sit around being a meat robot inputting 9 passwords at the beginning of each month just so I can have a copy of my bank statements and electric bill? The whole point was that this was in a crontab.
astrodust 12y ago
You're deluding yourself. Security through obscurity is barely worth the effort. If you want this done in a fashion that's secure, deploy it on a small device like a Raspberry Pi and firewall that thing so aggressively you can barely get in. It's hard to hack what you can't connect to.

kemayo 12y ago

Note to self: add "cnffjbeq" to my password-finder scripts.

NoMoreNicksLeft 12y ago
Might as well add rot-1 through rot-25 to it as well... not like there's a storage constraint, is there?

kedean 12y ago

That's pretty heavy security through obscurity. A more robust solution would be to have all of those passwords encrypted with a master key. You can make the script prompt you for the master key when you start it up, then it runs without needed any more input, but you aren't storing sensitive information.

NoMoreNicksLeft 12y ago
Yes. A master key. Which would have to be included in the perl script... so that when they find the script, they have all my passwords instead of just a few. You've solved it. Why didn't I think of that? > You can make the script prompt you for the master key when you start it up, Why the fuck would I want to sit around being a meat robot inputting 9 passwords at the beginning of each month just so I can have a copy of my bank statements and electric bill? The whole point was that this was in a crontab.

astrodust 12y ago

You're deluding yourself. Security through obscurity is barely worth the effort. If you want this done in a fashion that's secure, deploy it on a small device like a Raspberry Pi and firewall that thing so aggressively you can barely get in. It's hard to hack what you can't connect to.