I use a LastPass CLI client that I can pass in to other scripts or bash functions like my frequently used SSH invocations. Works great.
Edit: Here’s a link https://github.com/lastpass/lastpass-cli
How to handle secrets on the command line
41–50 of 77 posts
Re: How to handle secrets on the command line
#42Sidenote: I really like the cookie consent form on this site. It's unobtrusive, clear, opt-out by default and the highlighted and only button is "Continue to site". And it even has a built-in GDPR request form! Bravo to https://www.clym.io/ Nice article, covers the basics well. Credential files seem like simplest way to go and are secure enough for most local uses. For anything more involved a secrets manager is prob…
> idontcareaboutcookies
Re: How to handle secrets on the command line
#43Sidenote: I really like the cookie consent form on this site. It's unobtrusive, clear, opt-out by default and the highlighted and only button is "Continue to site". And it even has a built-in GDPR request form! Bravo to https://www.clym.io/ Nice article, covers the basics well. Credential files seem like simplest way to go and are secure enough for most local uses. For anything more involved a secrets manager is prob…
In a maximised browser window on a 13" screen it floats above and covers up the first few characters of each line of body copy, and it’s sticky, so it moves with me as I scroll. If I have to interact with it to read the article, it’s not unobtrusive.
Re: How to handle secrets on the command line
#44> Local (unexported) environment variables are also easy to leak into ps output
...and then the variable containing the secret is expanded in a non-builtin simple command in the following snippet. It is taking a gun, pointing it at your leg, and pulling the trigger, very deliberately, if you know how POSIX shells work.
Re: How to handle secrets on the command line
#45In the programming language I’m working on, MethodScript, I’ve created a subclass of string, secure_string. The normal print value is “secure string”. Unlike somewhat equivalent classes in other languages, this is a subclass of string, which means it can be passed around opaquely to things that only accept strings, but then the functions that actually need to be aware of secrets can check for the subclass and call th…
Should be fairly straightforward to implement in say Python?
If it quacks like a duck…
Re: How to handle secrets on the command line
#46sysctl -q proc.cmdline=0400
Re: How to handle secrets on the command line
#47I use a LastPass CLI client that I can pass in to other scripts or bash functions like my frequently used SSH invocations. Works great. Edit: Here’s a link https://github.com/lastpass/lastpass-cli
Could you post a link to the client?
Re: How to handle secrets on the command line
#48I'm currently using Doppler (https://www.doppler.com/) but I'm not sure if it sidesteps the issues outlined in the article.
Re: How to handle secrets on the command line
#49The difficulties mentioned in the article with passing secrets on the command line is one of the reasons why we wrote encpass.sh (https://github.com/plyint/encpass.sh). We had a similar need for a lightweight solution for managing secrets for simple shell scripts on our local workstations and in restricted environments. Bonus, it can be easily customized with extension scripts to adapt functions for your own specific needs. See our keybase extension for an example -> https://github.com/plyint/encpass.sh/blob/master/extensions/...
Re: How to handle secrets on the command line
#50Sidenote: I really like the cookie consent form on this site. It's unobtrusive, clear, opt-out by default and the highlighted and only button is "Continue to site". And it even has a built-in GDPR request form! Bravo to https://www.clym.io/ Nice article, covers the basics well. Credential files seem like simplest way to go and are secure enough for most local uses. For anything more involved a secrets manager is prob…
> idontcareaboutcookies
You mean, takemydata