Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

The .netrc file can contain username and password credentials for various sites, to allow simpler invocation of tools. For example curl with the -n option will read credentials from the file, for the given target site. Or FTP does similar.

Also custom written command-line tools and scripts can be designed to read credentials from the same file.

Assuming the file itself has 0400 permissions, Is this generally considered to be safe? different people seem to have different opinions.

share|improve this question
    
Also custom written command-line tools and scripts can be designed to read credentials from the same file. Kinda answered your own question, there. s/curl/evil_bot/. –  Parthian Shot Jul 22 at 0:35

1 Answer 1

Storing credentials in clear-text on your computer is a risky business as any application that runs on your computer has access to these credentials. The credentials are also exposed in backups, zips, etc...

.netrc files are a prime target for attackers looking to branch out to other computers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.