On Tue, Jan 07, 2003 at 09:18:00AM +0000, Jez Hancock wrote:
[snip]

> It's annoying in that I see a lot of users running mysql with the -u and -p options:
>
> mysql -u user -p mypassword
>
> on the commandline, thinking that this info will not show up in ps listings when ps
> is run by other users. Ho hum...

Any program that asks for a password on the command line should have
the common decency to overwrite/obfuscate it, along the lines of,

case 'p':
passwd = optarg;
optarg = "********";
break;

So that it doesn't show up in any "ps" output.

Of course, there is still a window of vulnerability before the code is
executed, but any long-lived daemon has no excuse for not doing this.
--
Crist J. Clark | cjclark (at) alum.mit (dot) edu [email concealed]
| cjclark (at) jhu (dot) edu [email concealed]
http://people.freebsd.org/~cjc/ | cjc (at) freebsd (dot) org [email concealed]

[ reply ]