在命令行中隐藏密码字段

Question

I am writing a system service on FreeBSD where I need to take user credentials to verify identity, something like this:

./compression_bin -i <input_file> --type=<type> --password=<secret key>

Here, the secret key is used to authenticate user before compressing the given file. Currently, the secret key shows up in history which is bad and can be exploited. Is there a way where above can be invoked without displaying password field:

./compression_bin -i <input_file> --type=<type> --password=*********

Answer 1

The history will always record the text of the commands as they were issued. You could conceivably go back and modify the history file, but not only is that nasty, it still affords a window within which the password can be read.

Moreover, that's not even the easiest exploit. If the password is given on the command line then there are other ways it can be read while the command is running, such as from the output of the ps command, which is accessible to all users.

So don't take the password as a command-line argument. Read it from a file or from the standard input or from a socket, or some other such thing.