[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#37196: 27.0.50; auth-source no longer obfuscates passwords

From: Lars Ingebrigtsen
Subject: bug#37196: 27.0.50; auth-source no longer obfuscates passwords
Date: Tue, 27 Aug 2019 12:29:43 +0200

Emacs got a better pretty printer for compiled code sometime over the
last few years, and that means that the obfuscator that auth-source uses
no longer works.  (It puts the password into a closure.)

With the following in ~/.authinfo

machine foo.bar login zot password foobar

we get

(auth-source-search :max 1 :host "foo.bar")
=> ((:host "foo.bar" :user "zot" :secret #[0 "<binary>" [("foobar") (nil)] 3]))

with the "foobar" clearly printed out.  This should be fixed by
obfuscating the password in a different way.

Similarly, the printed representation of auth-source-netrc-cache also
has the password in clear text now.

In GNU Emacs 27.0.50 (build 27, x86_64-pc-linux-gnu, GTK+ Version 3.22.11)
 of 2019-08-23 built on marnie
Repository revision: b4065de33cf397b80e15c22740d34b4a03cfdc17
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.11902000
System Description: Debian GNU/Linux 9 (stretch)

(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

reply via email to

[Prev in Thread] Current Thread [Next in Thread]