search

yousefvand / secret-service

Service to keep secrets of applications
MIT License
85 stars 11 forks source link

Putting the master password in the environment is not especially secure #11

Closed okapia closed 2 years ago

okapia commented 3 years ago

At a minimum, it'd be nice to have some alternative such as reading it from a pipe or socket so I could use gpg -q -d file as the source for the password. Even better would be if I could start the daemon as part of the usual desktop startup with no password available and there would be a way to unlock it by supplying a password later, perhaps via a Unix domain socket.

The environment for processes is visible in /proc (within limits of Unix permissions). For someone not using systemd it could be very tempting to use env when launching secretserviced which is even worse because it then appears in process listings. For what it is worth, secretserviced works perfectly well on FreeBSD so there is no need for systemd.

yousefvand commented 3 years ago

I'm aware of the problem and this was the quick and dirty solution I came up with. I'm open to new solutions so feel free and make PR.