apikey and secretkey stored in plain text in (world readable) history file

[hrak]

When set apikey xyz or set secretkey xyz are executed on the cloudmonkey prompt, the command is stored verbatim into the history, potentially exposing sensitive data into a file that is world readable by default.

[DaanHoogland]

@hrak any way forward (exept not writing out history) that you know of?

[hrak]

Move away from using github.com/chzyer/readline as it appears to be abandoned (no changes since 2017) and has insecure defaults.

There's a small bit of activity in feb this year. I will open a ticket there and see if it gains any traction.

[hrak]

Ticket here chzyer/readline#245

[rohityadavcloud]

Or we can add a workaround in our CLI

[DaanHoogland]

well, if they do not respond, I'd rather go for a replacement (provided it is drop-in) instead of maintaining such a workaround.

[shwstppr]

@rohityadavcloud @DaanHoogland any suggestion, should we go for a different fork or in-code workaround?

Tentatively adding to 6.5.0 milestone

[rohityadavcloud]

suggestions;

• ensure the config file is not world readable (i.e. modbit - 640)
• base64 encoding of apikey/secrekey & passwords
• explore using OS provided keyring to https://github.com/zalando/go-keyring

[shwstppr]

@hrak @rohityadavcloud I've implemented #166 to handle the file permissions.
I'll look into the feasibility of improvements in #157 (comment)
Feel free to re-open if any issues