Timeline for Is this password inside a file secure? A security paradox
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 18, 2016 at 23:43 | vote | accept | Get-HomeByFiveOClock | ||
| Jan 16, 2016 at 15:16 | history | edited | Get-HomeByFiveOClock | CC BY-SA 3.0 |
Clarifications on this problem and associated feedback
|
| Jan 16, 2016 at 2:01 | comment | added | Get-HomeByFiveOClock | But it is useful in the sense that it is required to be saved somewhere on the computer for a task I am running! Of course, I know the password in my head, but when "x chron-job" or "y-scheduled task" runs at midnight while I am asleep; the computer does not require me to manually enter the password. | |
| Jan 16, 2016 at 1:54 | comment | added | TessellatingHeckler | @Get-HomeByFiveOClock because this isn't a solution. At the risk of repeating my previous comment, if you have the password you don't gain anything from the file existing because you don't need to look at the file. If you need the password, you don't gain anything from the file existing because you can't read the file. The file might or might not be 'secure', but it's not useful. (Alternately, if you're saying "I logged in earlier and validated my login, can I unlock the file later to get my password using my previous auth" - I think you're reinventing Kerberos tickets, only not as good). | |
| Jan 15, 2016 at 23:51 | answer | added | Neil Smithline | timeline score: 0 | |
| Jan 15, 2016 at 23:43 | comment | added | Get-HomeByFiveOClock | Yes @SteveSether , that was the exact scenario. For this particular task, I need to re-enter my credentials in one of the steps required to complete the automated task as the command I was calling has the username and password combination as a require parameter. Once again, I know there are a plethora of established ways to accomplish this, but I am just very curious why this way is not in use as it seems like a very simple solution and I can't -for the life of me- figure out why it is wrong; but it just leaves a sense of "wrongness" about it. | |
| Jan 15, 2016 at 22:10 | comment | added | Steve Sether | I'm assuming there's some automated process that needs the password inside password.txt? Otherwise Tessellating is right, it's a pointless catch-22 exercise. | |
| Jan 15, 2016 at 22:00 | answer | added | Xander | timeline score: 2 | |
| Jan 15, 2016 at 21:39 | comment | added | TessellatingHeckler | Why bother reading the password out of a file, if you already have the password before you open the file? The logical flaw would be that the point of storing a password in a file is so you can get the password out when you don't know the password. If you need to know the password to get the password, you put yourself in a catch 22 - if you have the password you don't need the file. If you don't have the password you need the file but can't have it. If you don't need the file, you can have it. If you need the file you can't have it. (Is there a "security by bureaucracy"?) | |
| Jan 15, 2016 at 21:38 | review | First posts | |||
| Jan 15, 2016 at 22:30 | |||||
| Jan 15, 2016 at 21:33 | history | asked | Get-HomeByFiveOClock | CC BY-SA 3.0 |