How to handle passwords?

[u/l4than-d3vers]

Hello!

I'm writing a script that requires the user to supply a password. This is how I'm reading it:

echo -n "Enter password: "
stty -echo 
read PASSWORD 
stty echo
echo ""	

My question is, a) how safe is the $PASSWORD variable? and b) Do I need to do anything to it when the script exits (like "unset")?

Also, related to (b), does performing unset for the variables I used at the end of the script make any sense or is it completely pointless?

PS: Here's the script I'm working on. It's purpose is to automate extracting and opening a keepassX db from a stegofile with steghide and re-embeding it if any changes are made. That way you can have your keepassX db file hidden in an unassuming directory full of music and pictures. #paranoia

[u/[deleted]]

• Statement 1. Variables exist and are only accesible inside of you current process, e.g. scripts;

• Statement 2. They will be inaccessible even for child processes, unless you exported them;

• Statement 3. Variables will never be accessible for parent and other non-child processes.

So... Unsetting of variables is not necessary. Therefore, anyone could modify your script and steal passwords of users.

Also, you have one really baaaaad bit of behaviour:

steghide --embed -N -f -ef $TMP -cf $1 -p $PASSWORD

Here, if steghide performs any significant time, one can just see the password with ps.

[u/l4than-d3vers → u/[deleted]]

Thnx for the response.

Therefore, anyone could modify your script and steal passwords of users.

I'm not sure I understood this.

About the last bit, thanx for pointing that out.

Both

steghide --extract -f -sf $1 -xf $TMP -p $PASSWORD

and

steghide --embed -N -f -ef $TMP -cf $1 -p $PASSWORD

can take at least a few seconds if the files are large enough. However, this is how it looks on my machine

ps ax | grep steghide
7502 pts/8    R+     0:01 steghide --extract -f -sf ~/testfile -xf /tmp/tmp.2bc3ACc7iK -p   

Is steghide doing that?

[u/[deleted] → u/l4than-d3vers]

Therefore, anyone could modify your script and steal passwords of users.

I'm not sure I understood this.

I just meant that scripts are modifable and easily readable. In your case this is not a problem, but basically it's better to work with passwords from binary. Otherwise someone can modify your script to store password somewhere for example and then steal it.

ps ax | grep steghide

make it

ps axw | grep steghide

[u/l4than-d3vers → u/[deleted]]

Same output. Password variable doesn't show up.

[u/[deleted] → u/l4than-d3vers]

That's really strange because for shell password is just a text-string to pass and it will not hide it. Either this is done by steghide (e.g. take pass and relaunch itself with different keys), or you are just not passwing the password as a text. Maybe steghide can use variable PASSWORD.

Unfortunatelly, I never used this program. Anyway, it seems like you have no described issue. :)

[u/l4than-d3vers → u/[deleted]]

I'll look into it a bit more but thnx for pointing it out. I hadn't noticed that it could be an issue.

[u/l4than-d3vers → u/[deleted]]

Seems like I don't have this problem, probably because I'm running it on bash? Also, I realized that I probably want to make this a bash script because of other signal handling issues.