Is it insecure to send a password in a `curl` command?












20















Here’s an example request we can make to the GitHub API:



curl 'https://api.github.com/authorizations' --user "USERNAME"


This will prompt for the account password, to continue:



Enter host password for user 'USERNAME':


If we don’t want to get the prompt, we can provide the password at the same time as the username:



curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?






macosx curl







share|improve this question



























    20















    Here’s an example request we can make to the GitHub API:



    curl 'https://api.github.com/authorizations' --user "USERNAME"


    This will prompt for the account password, to continue:



    Enter host password for user 'USERNAME':


    If we don’t want to get the prompt, we can provide the password at the same time as the username:



    curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


    But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?






    macosx curl







    share|improve this question

























      20












      20








      20


      3






      Here’s an example request we can make to the GitHub API:



      curl 'https://api.github.com/authorizations' --user "USERNAME"


      This will prompt for the account password, to continue:



      Enter host password for user 'USERNAME':


      If we don’t want to get the prompt, we can provide the password at the same time as the username:



      curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


      But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?






      macosx curl







      share|improve this question














      Here’s an example request we can make to the GitHub API:



      curl 'https://api.github.com/authorizations' --user "USERNAME"


      This will prompt for the account password, to continue:



      Enter host password for user 'USERNAME':


      If we don’t want to get the prompt, we can provide the password at the same time as the username:



      curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


      But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?






      macosx curl




      macosx curl






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked yesterday









      user137369user137369

      24017




      24017






















          3 Answers
          3






          active

          oldest

          votes


















          45














          Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



          Locally this might be less secure, because:




          • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

          • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

          • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.






          share|improve this answer





















          • 22





            And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

            – dave_thompson_085
            yesterday






          • 1





            Then you must keep the script in a safe place. I'd recommend 700 permissions.

            – Esa Jokinen
            yesterday






          • 4





            to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

            – Anticom
            yesterday






          • 7





            This doesn't solve the /proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

            – Stephen Touset
            yesterday






          • 1





            @StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.

            – Wildcard
            yesterday





















          5














          No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



          But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



          TCPDUMP



          [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


          TSHARK



          [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





          share|improve this answer

































            3














            The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.






            share|improve this answer























              Your Answer








              StackExchange.ready(function() {
              var channelOptions = {
              tags: "".split(" "),
              id: "162"
              };
              initTagRenderer("".split(" "), "".split(" "), channelOptions);

              StackExchange.using("externalEditor", function() {
              // Have to fire editor after snippets, if snippets enabled
              if (StackExchange.settings.snippets.snippetsEnabled) {
              StackExchange.using("snippets", function() {
              createEditor();
              });
              }
              else {
              createEditor();
              }
              });

              function createEditor() {
              StackExchange.prepareEditor({
              heartbeatType: 'answer',
              autoActivateHeartbeat: false,
              convertImagesToLinks: false,
              noModals: true,
              showLowRepImageUploadWarning: true,
              reputationToPostImages: null,
              bindNavPrevention: true,
              postfix: "",
              imageUploader: {
              brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
              contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
              allowUrls: true
              },
              noCode: true, onDemand: true,
              discardSelector: ".discard-answer"
              ,immediatelyShowMarkdownHelp:true
              });


              }
              });














              draft saved

              draft discarded


















              StackExchange.ready(
              function () {
              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205479%2fis-it-insecure-to-send-a-password-in-a-curl-command%23new-answer', 'question_page');
              }
              );

              Post as a guest















              Required, but never shown

























              3 Answers
              3






              active

              oldest

              votes








              3 Answers
              3






              active

              oldest

              votes









              active

              oldest

              votes






              active

              oldest

              votes









              45














              Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



              Locally this might be less secure, because:




              • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

              • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

              • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.






              share|improve this answer





















              • 22





                And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

                – dave_thompson_085
                yesterday






              • 1





                Then you must keep the script in a safe place. I'd recommend 700 permissions.

                – Esa Jokinen
                yesterday






              • 4





                to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

                – Anticom
                yesterday






              • 7





                This doesn't solve the /proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

                – Stephen Touset
                yesterday






              • 1





                @StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.

                – Wildcard
                yesterday


















              45














              Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



              Locally this might be less secure, because:




              • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

              • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

              • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.






              share|improve this answer





















              • 22





                And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

                – dave_thompson_085
                yesterday






              • 1





                Then you must keep the script in a safe place. I'd recommend 700 permissions.

                – Esa Jokinen
                yesterday






              • 4





                to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

                – Anticom
                yesterday






              • 7





                This doesn't solve the /proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

                – Stephen Touset
                yesterday






              • 1





                @StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.

                – Wildcard
                yesterday
















              45












              45








              45







              Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



              Locally this might be less secure, because:




              • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

              • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

              • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.






              share|improve this answer















              Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



              Locally this might be less secure, because:




              • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

              • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

              • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.







              share|improve this answer














              share|improve this answer



              share|improve this answer








              edited yesterday

























              answered yesterday









              Esa JokinenEsa Jokinen

              2,9741119




              2,9741119








              • 22





                And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

                – dave_thompson_085
                yesterday






              • 1





                Then you must keep the script in a safe place. I'd recommend 700 permissions.

                – Esa Jokinen
                yesterday






              • 4





                to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

                – Anticom
                yesterday






              • 7





                This doesn't solve the /proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

                – Stephen Touset
                yesterday






              • 1





                @StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.

                – Wildcard
                yesterday
















              • 22





                And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

                – dave_thompson_085
                yesterday






              • 1





                Then you must keep the script in a safe place. I'd recommend 700 permissions.

                – Esa Jokinen
                yesterday






              • 4





                to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

                – Anticom
                yesterday






              • 7





                This doesn't solve the /proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

                – Stephen Touset
                yesterday






              • 1





                @StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.

                – Wildcard
                yesterday










              22




              22





              And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

              – dave_thompson_085
              yesterday





              And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

              – dave_thompson_085
              yesterday




              1




              1





              Then you must keep the script in a safe place. I'd recommend 700 permissions.

              – Esa Jokinen
              yesterday





              Then you must keep the script in a safe place. I'd recommend 700 permissions.

              – Esa Jokinen
              yesterday




              4




              4





              to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

              – Anticom
              yesterday





              to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

              – Anticom
              yesterday




              7




              7





              This doesn't solve the /proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

              – Stephen Touset
              yesterday





              This doesn't solve the /proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

              – Stephen Touset
              yesterday




              1




              1





              @StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.

              – Wildcard
              yesterday







              @StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.

              – Wildcard
              yesterday















              5














              No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



              But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



              TCPDUMP



              [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


              TSHARK



              [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





              share|improve this answer






























                5














                No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



                But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



                TCPDUMP



                [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


                TSHARK



                [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





                share|improve this answer




























                  5












                  5








                  5







                  No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



                  But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



                  TCPDUMP



                  [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


                  TSHARK



                  [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





                  share|improve this answer















                  No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



                  But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



                  TCPDUMP



                  [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


                  TSHARK



                  [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x






                  share|improve this answer














                  share|improve this answer



                  share|improve this answer








                  edited yesterday

























                  answered yesterday









                  MuhammadMuhammad

                  725718




                  725718























                      3














                      The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.






                      share|improve this answer




























                        3














                        The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.






                        share|improve this answer


























                          3












                          3








                          3







                          The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.






                          share|improve this answer













                          The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.







                          share|improve this answer












                          share|improve this answer



                          share|improve this answer










                          answered yesterday









                          sitaramsitaram

                          792




                          792






























                              draft saved

                              draft discarded




















































                              Thanks for contributing an answer to Information Security Stack Exchange!


                              • Please be sure to answer the question. Provide details and share your research!

                              But avoid …



                              • Asking for help, clarification, or responding to other answers.

                              • Making statements based on opinion; back them up with references or personal experience.


                              To learn more, see our tips on writing great answers.




                              draft saved


                              draft discarded














                              StackExchange.ready(
                              function () {
                              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205479%2fis-it-insecure-to-send-a-password-in-a-curl-command%23new-answer', 'question_page');
                              }
                              );

                              Post as a guest















                              Required, but never shown





















































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown

































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown







                              -

                              Popular posts from this blog

                              "Incorrect syntax near the keyword 'ON'. (on update cascade, on delete cascade,)

                              Image
                              .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 2 total noob sorry any help greatly appreciated. I keep getting this "Incorrect syntax near the keyword 'ON'." heres my codes code one CREATE TABLE supplier ( supplierID INT PRIMARY KEY, ISBN INT FOREIGN KEY REFERENCES book(ISBN), price DECIMAL (5,2), ON UPDATE CASCADE, ON DELETE CASCADE, ); code two CREATE TABLE orders ( orderID INT PRIMARY KEY, customerID INT FOREIGN KEY REFERENCES customer(customerID), ISBN INT FOREIGN KEY REFERENCES book(ISBN), orderDate date, ON UPDATE CASCADE, ON DELETE CASCADE, ); Ive run out of stuff to try other than dumbing it down to uselessness. ...
                              Read more

                              Alcedinidae

                              Image
                              Alcedinidae Martin-pêcheur à dos bleu ( Alcedo azurea ) Classification (COI) Règne Animalia Embranchement Chordata Sous-embr. Vertebrata Classe Aves Ordre Coraciiformes Famille Alcedinidae Rafinesque, 1815 Les Alcédinidés ou Alcedinidae forment une famille d'oiseaux plus connus sous les noms de martins-pêcheurs et martins-chasseurs. Sommaire 1 Description 2 Répartition et habitat 3 Systématique 3.1 Liste alphabétique des genres 3.2 Liste des espèces 4 Chez les Anciens : l'alcyon 4.1 Étymologie (Littré) 4.2 Oiseau « fabuleux » ? 5 Notes 6 Articles connexes 7 Liens externes 7.1 Bibliographie Description | Ce sont des oiseaux compacts de taille petite à moyenne (10 à 46 cm), au bec droit et long, en forme de poignard. Leurs pattes sont courtes, et ils portent un plumage aux couleurs vives. Répartition et habitat | Cosmopolites, ils fréquentent surtout ...
                              Read more

                              Origin of the phrase “under your belt”?

                              Image
                              .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0; } 17 1 Today, I found myself discussing what students should have "under their belts" during a lecture, and I wondered to myself if there was some inappropriate undertone here that I might be unaware of. Question : What is the origin of the phrase "under your belt"? A google search revealed some webpages (e.g. [1]) that assert its origin is related to consumption of food -- once a meal has been eaten, it's under your belt (which is a relief). However, with such websites, I have no way to determine fact from "random guy on the internet making stuff up". etymology idioms ...
                              Read more