Seems like a pretty basic security precaution to avoid loading decrypted secrets into memory before they're needed. Someone who can access application memory can already own you but there isn't really a good reason why they should be able to access secrets that you never accessed while they were in.
I wouldn't say it's an alarming flaw, just seems weirdly and unnecessarily unsafe
Yep, and at that point they will be in memory until a reasonable time to clean up. But decrypting the whole password database and leaving it there forever seems needlessly unsafe.
8 Comments
rando@sh.itjust.works · 15 pts · 118d
Use a real password manager people
craneum_@lemmy.zip · 17 pts · 118d
*operating system
possiblylinux127@lemmy.zip · 10 pts · 118d
This requires reading application memory
kogasa@programming.dev · 16 pts · 118d
Seems like a pretty basic security precaution to avoid loading decrypted secrets into memory before they're needed. Someone who can access application memory can already own you but there isn't really a good reason why they should be able to access secrets that you never accessed while they were in.
I wouldn't say it's an alarming flaw, just seems weirdly and unnecessarily unsafe
possiblylinux127@lemmy.zip · 2 pts · 117d
At some point they will need to be decrypted anyway
I think this was done for performance and simplicity
kogasa@programming.dev · 2 pts · 117d
Yep, and at that point they will be in memory until a reasonable time to clean up. But decrypting the whole password database and leaving it there forever seems needlessly unsafe.
ejs@piefed.social · 5 pts · 117d
TIL: If you
cat /proc/sys/kernel/yama/ptrace_scopeon your linux distro:Most distros have this set to 1 by default.
More details:
man 2 ptrace, search using/:scopefavoredponcho@lemmy.zip · 2 pts · 118d
experimentmapass@social.trom.tf · -13 pts · 118d
TachyonTele@piefed.social · 2 pts · 118d
Two years and you end it all with that? Oook