From: jim@gonzul.net (Jim Cheetham)
Subject: [sup-talk] Encrypted password in configuration file
Date: Fri, 28 Aug 2009 14:37:48 +1200 [thread overview]
Message-ID: <f4cc59760908271937t764e61aeh7f105c7195fec1ce@mail.gmail.com> (raw)
In-Reply-To: <20090824215435.182e0007@ronin.larsko.net>
On Tue, Aug 25, 2009 at 8:54 AM, Lars Kotthoff<lists at larsko.org> wrote:
> Hi list,
>
> ?is it possible to store the account password encrypted in the configuration
> file?
It's possible, but slightly pointless.
Have a read of Eric Raymond's discussions about Fetchmail, which has
the same configuration data :-
http://www.catb.org/~esr/writings/cathedral-bazaar/cathedral-bazaar/ar01s09.html
"Another lesson is about security by obscurity. Some fetchmail users
asked me to change the software to store passwords encrypted in the rc
file, so snoopers wouldn't be able to casually see them.
I didn't do it, because this doesn't actually add protection. Anyone
who's acquired permissions to read your rc file will be able to run
fetchmail as you anyway?and if it's your password they're after,
they'd be able to rip the necessary decoder out of the fetchmail code
itself to get it.
All .fetchmailrc password encryption would have done is give a false
sense of security to people who don't think very hard. The general
rule here is:
17. A security system is only as secure as its secret. Beware of
pseudo-secrets."
-jim
next prev parent reply other threads:[~2009-08-28 2:37 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-08-24 20:54 Lars Kotthoff
2009-08-28 2:37 ` Jim Cheetham [this message]
[not found] ` <20090828012502.15484x8musndy5mo@webmail.seas.upenn.edu>
2009-08-28 7:07 ` Jim Cheetham
2009-08-28 7:23 ` Lars Kotthoff
2009-08-28 9:28 ` Jim Cheetham
2009-08-28 20:29 ` William Morgan
2009-08-28 22:48 ` Mike Kelly
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f4cc59760908271937t764e61aeh7f105c7195fec1ce@mail.gmail.com \
--to=jim@gonzul.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox