I have this problem:
- My console app needs to connect to a server. However, the server requires passwords in plain text per HTTP POST for login. The connection is HTTPS.
- The app is only called now and then, but does not run permanently.
Now, I don't want the user to enter his or her password for every run of the app. My idea was:
- When the user starts the app for the first time, the user is being asked for a password. A new deamon is being started (i.e. a program executed by the user, which can run for mulitple weeks), and the entered password is passed directly to the deamon.
- To login to the homepage, the app only tells the demon "login". The demon, which has the password in RAM, calls wget to login to the website .
My main worry is that the deamon has the password in RAM. What dangers could arrise from this?
I see three risks:
- Someone could access the RAM. Probably by forcing your computer to swap it out, then pressing the power button, and then investigating you hard disk. It's possible, but probably not effective.
- The deamon could use temporary files to store it's memory. Probably true for bash? However, if I'll write a C program, this should not be possible?
- Someone could use a script which says "Hi deamon, I'm wget/the internet, give me the password". As long as I'll call "/usr/bin/wget", and as long as the user isn't root, I think that won't be possible?
Any other issues?
 wget gets the password via a file, so the password is not in the
ps-table. The file would be constructed by the demon with read-rights only for the user, and would be deleted after the login.