Passing password through terminal when using pass + gpg

Question

I'm planning to use the pass to store passwords for a web service. My service will need to store passwords for many database servers. So my idea is store these passwords with the Linux pass command. I created a class in typescript that invokes the command with the show option. I configured gpg to use pinentry-tty instead of the graphical dialog to ask for the password so I can pass the password by stdin now. Is this secure? There is any issue using this method. For example, it is possible for other process to log my entry. If sudo command receives a password from the standard input, how can I achieve the same?

Answer 1

I really don’t want to be ‘that guy’ that just points out flaws, but seeing as more knowledgeable people can suggest alternatives or mitigations, off the top of my head here are some risks with your idea:

1. Input Logging Risks Other processes with elevated privileges (like root or those with specific permissions) could capture input from stdin, including passwords.

2. Temporary File Security Passwords might be inadvertently written to disk or retained in memory longer than necessary, leading to potential ( and again, this is only potential) exposure.

3. Handling sudo with Stdin: I’m pretty sure sudo does not accept passwords from stdin directly for security reasons, and using methods like expect can introduce additional risks if not handled securely. This is called Expect scripting.

Just for some initial information.