square / subzero

Block's Bitcoin Cold Storage solution.
Apache License 2.0
685 stars 96 forks source link

[java] don't echo the ACS password when running the --init-nvram command #677

Closed ivmaykov closed 1 year ago

ivmaykov commented 1 year ago

I discovered that the ACS password is echoed to the screen when running the GUI with the --init-nvram option. This is obviously bad as anyone present in the room would be able to see the password. Fixed by using System.console().readPassword() instead of reading from System.in.

Tested on my at-home HSM machine, both with and without a framebuffer, works as expected.