I'm building a number of automated scripts that will run within an encrypted environment (full disk encryption).
Many commands in both Windows and *nix have two ways of entering sensitive information such as passwords. In one mode, the program prompts the user for the password, and in the other, the password is specified using an option argument.
When writing a shell script, the command can be automated using either of these processes. In the first case, the command is executed, then standard in (stdin) is redirected and the password is piped into the program when prompted. In the second case, the password is specified as an argument to the program.
Is one of these inherently more risky than the other? Are there any trade-offs to be aware of? In either case, I'm asking specifically about the method of supplying the password, not the riskiness or vulnerability associated with storing the password on disk.
Here is an example in Python, using the CLI versio of VeraCrypt:
Redirecting stdin:
cmd = ['veracrypt', "--text", partition, mount_point]
input_file = open_file()
vc_call = subprocess.run(cmd, stdin=input_file)
vc_call.wait()
Passing the password as an argument:
password = get_password_from_file():
cmd = ['veracrypt', "--text", "--non-interactive", "--password", password, partition, mount_point]
vc_call = subprocess.run(cmd)
note:
I'm not sure if it matters, but on *nix, commands can be executed directly as system calls. In the above code, neither of the calls to subprocess.run()
were given a shell=True
option, which would cause the command to be executed within the default shell. My understanding is that on Windows, all commands must be run through the cmd
shell. This could make a difference between the the two options, but I'm not sure how.