How safe are local variables?

Question

I am writing a kind of dinky program in c which requires the user to enter a username and password. I know it's not really necessary, but I kind of like thinking about the security side of things. I hash the password before saving it to a file, but is it possible for another program to find the inputted password in memory during run-time? Is there any difference if the password is stored in the stack versus the heap? Is there any inherent vulnerability in returning the password from a function un-hashed rather than hashing it as soon as it is inputted?

Sorry if this is a little off topic, just a curious student :)

Answer 1

is it possible for another program to find the inputted password in memory during run-time?

Yes, if that program has permission to look at your program's memory. (On Windows and Linux, that means it has to be running as your user account or an administrator)

Note that if a program is running as you on Windows or Linux, it could theoretically already get the password (such as by making itself look like your program and asking you for the password).

Is there any difference if the password is stored in the stack versus the heap?

It might be a little bit harder to find on the heap, but it's possible to find either way.

Is there any inherent vulnerability in returning the password from a function un-hashed rather than hashing it as soon as it is inputted?

Not inherently - but the more steps between the password input and the hashing, the higher the likelihood of you making a mistake and somehow exposing the password accidentally.