Is it insecure to send a password in a `curl` command?
Here’s an example request we can make to the GitHub API:
curl 'https://api.github.com/authorizations' --user "USERNAME"
This will prompt for the account password, to continue:
Enter host password for user 'USERNAME':
If we don’t want to get the prompt, we can provide the password at the same time as the username:
curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"
But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?
macosx curl
asked yesterday
user137369user137369
24017
add a comment |
Here’s an example request we can make to the GitHub API:
curl 'https://api.github.com/authorizations' --user "USERNAME"
This will prompt for the account password, to continue:
Enter host password for user 'USERNAME':
If we don’t want to get the prompt, we can provide the password at the same time as the username:
curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"
But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?
macosx curl
asked yesterday
user137369user137369
24017
add a comment |
Here’s an example request we can make to the GitHub API:
curl 'https://api.github.com/authorizations' --user "USERNAME"
This will prompt for the account password, to continue:
Enter host password for user 'USERNAME':
If we don’t want to get the prompt, we can provide the password at the same time as the username:
curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"
But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?
macosx curl
asked yesterday
user137369user137369
24017
Here’s an example request we can make to the GitHub API:
curl 'https://api.github.com/authorizations' --user "USERNAME"
This will prompt for the account password, to continue:
Enter host password for user 'USERNAME':
If we don’t want to get the prompt, we can provide the password at the same time as the username:
curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"
But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?
macosx curl
macosx curl
asked yesterday
user137369user137369
24017
asked yesterday
user137369user137369
24017
asked yesterday
user137369user137369
24017
asked yesterday
user137369user137369
24017
asked yesterday
user137369user137369
24017
24017
add a comment |
add a comment |
3 Answers
3
active
oldest
votes
Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.
Locally this might be less secure, because:
- The password gets saved to the command history (
~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it. - On a shared system, it will usually be visible to others in
ps,topand such, or by reading/proc/$pid/cmdline, for as long as the command is running. - Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.
answered yesterday
Esa JokinenEsa Jokinen
2,9741119
22
And if on a shared system, it will usually be visible to others inpsandtopand such, or by reading/proc/$pid/cmdline
– dave_thompson_085
yesterday
1
Then you must keep the script in a safe place. I'd recommend700permissions.
– Esa Jokinen
yesterday
4
to solve the issue with.bash_historyyou could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )
– Anticom
yesterday
7
This doesn't solve the/proc/${pid}/cmdlineissue (e.g., it showing up inpsoutput). If there are multiple users on a system, this is a great way to accidentally disclose a password.
– Stephen Touset
yesterday
1
@StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.
– Wildcard
yesterday
|
show 2 more comments
No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.
But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,
TCPDUMP
[root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX
TSHARK
[root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x
answered yesterday
MuhammadMuhammad
725718
add a comment |
The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.
answered yesterday
sitaramsitaram
792
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205479%2fis-it-insecure-to-send-a-password-in-a-curl-command%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.
Locally this might be less secure, because:
- The password gets saved to the command history (
~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it. - On a shared system, it will usually be visible to others in
ps,topand such, or by reading/proc/$pid/cmdline, for as long as the command is running. - Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.
answered yesterday
Esa JokinenEsa Jokinen
2,9741119
22
And if on a shared system, it will usually be visible to others inpsandtopand such, or by reading/proc/$pid/cmdline
– dave_thompson_085
yesterday
1
Then you must keep the script in a safe place. I'd recommend700permissions.
– Esa Jokinen
yesterday
4
to solve the issue with.bash_historyyou could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )
– Anticom
yesterday
7
This doesn't solve the/proc/${pid}/cmdlineissue (e.g., it showing up inpsoutput). If there are multiple users on a system, this is a great way to accidentally disclose a password.
– Stephen Touset
yesterday
1
@StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.
– Wildcard
yesterday
|
show 2 more comments
Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.
Locally this might be less secure, because:
- The password gets saved to the command history (
~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it. - On a shared system, it will usually be visible to others in
ps,topand such, or by reading/proc/$pid/cmdline, for as long as the command is running. - Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.
answered yesterday
Esa JokinenEsa Jokinen
2,9741119
22
And if on a shared system, it will usually be visible to others inpsandtopand such, or by reading/proc/$pid/cmdline
– dave_thompson_085
yesterday
1
Then you must keep the script in a safe place. I'd recommend700permissions.
– Esa Jokinen
yesterday
4
to solve the issue with.bash_historyyou could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )
– Anticom
yesterday
7
This doesn't solve the/proc/${pid}/cmdlineissue (e.g., it showing up inpsoutput). If there are multiple users on a system, this is a great way to accidentally disclose a password.
– Stephen Touset
yesterday
1
@StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.
– Wildcard
yesterday
|
show 2 more comments
Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.
Locally this might be less secure, because:
- The password gets saved to the command history (
~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it. - On a shared system, it will usually be visible to others in
ps,topand such, or by reading/proc/$pid/cmdline, for as long as the command is running. - Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.
answered yesterday
Esa JokinenEsa Jokinen
2,9741119
Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.
Locally this might be less secure, because:
- The password gets saved to the command history (
~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it. - On a shared system, it will usually be visible to others in
ps,topand such, or by reading/proc/$pid/cmdline, for as long as the command is running. - Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.
answered yesterday
Esa JokinenEsa Jokinen
2,9741119
edited yesterday
answered yesterday
Esa JokinenEsa Jokinen
2,9741119
answered yesterday
Esa JokinenEsa Jokinen
2,9741119
answered yesterday
Esa JokinenEsa Jokinen
2,9741119
2,9741119
22
And if on a shared system, it will usually be visible to others inpsandtopand such, or by reading/proc/$pid/cmdline
– dave_thompson_085
yesterday
1
Then you must keep the script in a safe place. I'd recommend700permissions.
– Esa Jokinen
yesterday
4
to solve the issue with.bash_historyyou could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )
– Anticom
yesterday
7
This doesn't solve the/proc/${pid}/cmdlineissue (e.g., it showing up inpsoutput). If there are multiple users on a system, this is a great way to accidentally disclose a password.
– Stephen Touset
yesterday
1
@StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.
– Wildcard
yesterday
|
show 2 more comments
22
And if on a shared system, it will usually be visible to others inpsandtopand such, or by reading/proc/$pid/cmdline
– dave_thompson_085
yesterday
1
Then you must keep the script in a safe place. I'd recommend700permissions.
– Esa Jokinen
yesterday
4
to solve the issue with.bash_historyyou could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )
– Anticom
yesterday
7
This doesn't solve the/proc/${pid}/cmdlineissue (e.g., it showing up inpsoutput). If there are multiple users on a system, this is a great way to accidentally disclose a password.
– Stephen Touset
yesterday
1
@StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.
– Wildcard
yesterday
22
22
And if on a shared system, it will usually be visible to others in
ps and top and such, or by reading /proc/$pid/cmdline– dave_thompson_085
yesterday
And if on a shared system, it will usually be visible to others in
ps and top and such, or by reading /proc/$pid/cmdline– dave_thompson_085
yesterday
1
1
Then you must keep the script in a safe place. I'd recommend
700 permissions.– Esa Jokinen
yesterday
Then you must keep the script in a safe place. I'd recommend
700 permissions.– Esa Jokinen
yesterday
4
4
to solve the issue with
.bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )– Anticom
yesterday
to solve the issue with
.bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )– Anticom
yesterday
7
7
This doesn't solve the
/proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.– Stephen Touset
yesterday
This doesn't solve the
/proc/${pid}/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.– Stephen Touset
yesterday
1
1
@StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.
– Wildcard
yesterday
@StephenTouset check here: unix.stackexchange.com/q/385339/135943. Curl password arguments do NOT appear in ps output, except possibly for a minuscule (and hard to demonstrate) time period after the curl command is invoked. Should not be relied on entirely for security but it’s pretty effective.
– Wildcard
yesterday
|
show 2 more comments
No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.
But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,
TCPDUMP
[root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX
TSHARK
[root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x
answered yesterday
MuhammadMuhammad
725718
add a comment |
No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.
But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,
TCPDUMP
[root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX
TSHARK
[root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x
answered yesterday
MuhammadMuhammad
725718
add a comment |
No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.
But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,
TCPDUMP
[root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX
TSHARK
[root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x
answered yesterday
MuhammadMuhammad
725718
No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.
But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,
TCPDUMP
[root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX
TSHARK
[root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x
answered yesterday
MuhammadMuhammad
725718
edited yesterday
answered yesterday
MuhammadMuhammad
725718
answered yesterday
MuhammadMuhammad
725718
answered yesterday
MuhammadMuhammad
725718
725718
add a comment |
add a comment |
The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.
answered yesterday
sitaramsitaram
792
add a comment |
The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.
answered yesterday
sitaramsitaram
792
add a comment |
The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.
answered yesterday
sitaramsitaram
792
The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.
answered yesterday
sitaramsitaram
792
answered yesterday
sitaramsitaram
792
answered yesterday
sitaramsitaram
792
answered yesterday
sitaramsitaram
792
792
add a comment |
add a comment |
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205479%2fis-it-insecure-to-send-a-password-in-a-curl-command%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
