Buy commercial curl support from WolfSSL. We help you work
out your issues, debug your libcurl applications, use the API, port to new
platforms, add new features and more. With a team lead by the curl founder
himself.
Re: credentials in memory
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Fri, 30 Sep 2022 13:41:08 +0200 (CEST)
On Fri, 30 Sep 2022, Stefan Eissing wrote:
> I know of threee patterns to solve this problem (and increase usability as a side effect):
Those methods transfer the data to another process, and that is certainly even
more safe since then the sensitive data is not even present in the heap of the
first process.
But: introducing a second process or a daemon or something for this purpose,
while safer, would be a significant new factor and complication that would
basically prevent a huge portion of our users from using it.
I think a simpler first step could be to just "scramble" the data while
"long-term stored" in memory.
Date: Fri, 30 Sep 2022 13:41:08 +0200 (CEST)
On Fri, 30 Sep 2022, Stefan Eissing wrote:
> I know of threee patterns to solve this problem (and increase usability as a side effect):
Those methods transfer the data to another process, and that is certainly even
more safe since then the sensitive data is not even present in the heap of the
first process.
But: introducing a second process or a daemon or something for this purpose,
while safer, would be a significant new factor and complication that would
basically prevent a huge portion of our users from using it.
I think a simpler first step could be to just "scramble" the data while
"long-term stored" in memory.
-- / daniel.haxx.se | Commercial curl support up to 24x7 is available! | Private help, bug fixes, support, ports, new features | https://curl.se/support.html -- Unsubscribe: https://lists.haxx.se/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2022-09-30