Escaping passwords

For discussions about security.
Post Reply
Message
Author
Wognath
Posts: 423
Joined: Sun 19 Apr 2009, 17:23

Escaping passwords

#1 Post by Wognath »

Very interesting Scooby's topic Bash removing passwords safely from RAM, but over my head. It might be useful to start a topic on simpler password visibility issues. I can contribute two.
1) After using fpm2, usernames and passwords that had been pasted into the browser were visible in glipper clipboard manager. Solution: kill glipper before starting fpm2
2) I recently used aescrypt to encrypt some text files, after which the passwords were visible in the history file. Solution: erase /root/.history

I'm a relatively naive user, so although I caught these, there are probably others I have missed. Are there similar situations to watch out for?

disciple
Posts: 6984
Joined: Sun 21 May 2006, 01:46
Location: Auckland, New Zealand

#2 Post by disciple »

Some clipboard managers have a feature to "pause" them without closing them, and also to remove entries from the history.
Do you know a good gtkdialog program? Please post a link here

Classic Puppy quotes

ROOT FOREVER
GTK2 FOREVER

proebler
Posts: 178
Joined: Tue 24 Jan 2012, 11:15
Location: TAS

#3 Post by proebler »

I have posted about the issue with fpm2 a long time ago.
Since I do like this simple password manager, I prevent glipper/parcellite from starting by default.
see:
http://www.murga-linux.com/puppy/viewto ... &start=510

edit 1

disciple
Posts: 6984
Joined: Sun 21 May 2006, 01:46
Location: Auckland, New Zealand

#4 Post by disciple »

I might be confused (maybe I'm thinking of the fork which has had most of its work merged back in), but I thought parcellite was one of the ones which enables you to pause recording the clipboard, as well as of course allowing you to manually remove an entry.
Do you know a good gtkdialog program? Please post a link here

Classic Puppy quotes

ROOT FOREVER
GTK2 FOREVER

Wognath
Posts: 423
Joined: Sun 19 Apr 2009, 17:23

Sylpheed

#5 Post by Wognath »

Sylpheed stores email passwords as plain text in .sylpheed/accountrc

@proebler Sorry I missed your post about fpm2

Post Reply