4

I am writing a kind of dinky program in c which requires the user to enter a username and password. I know it's not really necessary, but I kind of like thinking about the security side of things. I hash the password before saving it to a file, but is it possible for another program to find the inputted password in memory during run-time? Is there any difference if the password is stored in the stack versus the heap? Is there any inherent vulnerability in returning the password from a function un-hashed rather than hashing it as soon as it is inputted?

Sorry if this is a little off topic, just a curious student :)

5

is it possible for another program to find the inputted password in memory during run-time?

Yes, if that program has permission to look at your program's memory. (On Windows and Linux, that means it has to be running as your user account or an administrator)

Note that if a program is running as you on Windows or Linux, it could theoretically already get the password (such as by making itself look like your program and asking you for the password).

Is there any difference if the password is stored in the stack versus the heap?

It might be a little bit harder to find on the heap, but it's possible to find either way.

Is there any inherent vulnerability in returning the password from a function un-hashed rather than hashing it as soon as it is inputted?

Not inherently - but the more steps between the password input and the hashing, the higher the likelihood of you making a mistake and somehow exposing the password accidentally.

  • +1 I would also add that (at least in Linux) any program running as you in the same login session can easily subscribe to the keyboard bus and see the password as you're typing it. So, if there's malware running as you, it's game over already because there's no way to securely get the password to the application. – Mike Ounsworth Mar 22 '17 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.