Re: Password protection

[Ted Zlatanov <tzz@lifelogs.com>]

On Thu, 30 Sep 2010 18:47:58 +0200 Lars Magne Ingebrigtsen <larsi@gnus.org> wrote: 

LMI> Ted Zlatanov <tzz@lifelogs.com> writes:
>> If it doesn't break existing code, doesn't slow Emacs down, and provides
>> needed functionality we can't get in any other way, they'll probably OK
>> it.  Do you or Michael want to make a proposal or should I?

LMI> I'm not quite sure how it's going to be used, either.  Today, nnimap says

LMI> (process-send-string ... (format "LOGIN %S %S" user password))

LMI> That, obviously, can't work any more.  So in what circumstances will
LMI> this appear?  If it's only in new functions like process-send-password,
LMI> then it kinda seems like the type isn't needed, because we could just
LMI> load it into the C layer without ever exporting it back to the Lisp
LMI> layer at all...

But then you won't be able to pass the secret tokens around or examine
their hashes.  Those are valuable tools for debugging and building more
functionality around the secret tokens.  Generally I'd rather
encapsulate secrets safely than make them inaccessible.

Your example would not change.  I think it could be:

(let ((password (make-secret "hello")))
   (format "%s" password) ; #SECRET#abc123 is the unique one-way hash
   (process-send-string ... password) ; sends the password
   (process-send-string ... #SECRET#abc123) ; sends the password also
   (process-send-string ... (format "%s" #SECRET#abc123)) ; sends the externally useless hash
   (debug password)) ; shows #SECRET#abc123

So only process-send-string and C code would be able to look inside a
secret token.  It will complicate the example code a tiny bit.

Ted