search

eth-educators / ethstaker-deposit-cli

Secure key generation for deposits
https://eth-educators.github.io/ethstaker-deposit-cli/
Creative Commons Zero v1.0 Universal
3 stars 5 forks source link

Password as arguments accessible via shell history #33

Open valefar-on-discord opened 5 months ago

valefar-on-discord commented 5 months ago

Forward from:

The 2020 Audit of staking-deposit-cli mentioned not allowing users to use command line arguments to specify passwords. Doing so would make the password accessible through the bash history.

A potential solution is to remove the option for mnemonic password and keystore passwords are input arguments and only allow them as inputs when running the CLI unless the user is executing with non-interactive enabled.

remyroy commented 3 months ago

I like the idea of restricting those password flags only when running this under the non-interaction option. This would have to be well documented.

yorickdowne commented 2 weeks ago

We can't restrict --mnemonic_password, as that's the only way a user can input it. That user may not want to run --non_interactive. This is a niche use however, extremely so.

We can restrict --keystore_password.