Re: Password protection

[Lars Magne Ingebrigtsen <larsi@gnus.org>]

Ted Zlatanov <tzz@lifelogs.com> writes:

> But then you won't be able to pass the secret tokens around or examine
> their hashes.  Those are valuable tools for debugging and building more
> functionality around the secret tokens.  Generally I'd rather
> encapsulate secrets safely than make them inaccessible.

It has debugging value, but since you're not going to be able to ever
actually see their real value in the Lisp layer, but have to write
special C functions to do anything with them, I think it has low value
otherwise.  So it mainly has all the drawbacks connected with
introducing a new type.

If you wish to have some debuggability, you can just have a function
like `(secret-credential-hash "imap.gmail.com" "imaps" "password")'
to return a hash of the "password" secret that's stashed, and you don't
need any new type.

> Your example would not change.  I think it could be:
>
> (let ((password (make-secret "hello")))
>    (format "%s" password) ; #SECRET#abc123 is the unique one-way hash
>    (process-send-string ... password) ; sends the password
>    (process-send-string ... #SECRET#abc123) ; sends the password also
>    (process-send-string ... (format "%s" #SECRET#abc123)) ; sends the externally useless hash
>    (debug password)) ; shows #SECRET#abc123
>
> So only process-send-string and C code would be able to look inside a
> secret token.  It will complicate the example code a tiny bit.

No, I don't think that'd actually work.  To take an example: Passwords
in IMAP needs to be utf7-imap-encoded and quote-treated.  (I think.)  So if
you have the password "hello "&" goodbye", you need to do the following
transform:

(format "%S" (utf7-encode password) t)

and what gets sent will be

"hello \"&utf7-thing\" goodbye"

Oh.  Hm.  But that won't work with my simpler process-send-password
thing either.  I had thought of the transform (because if you send basic
auth, you need to base64-encode the stuff first), but
Fbase64_encode_string is a C string, so I though you could just send a
transform down, too.  But here you have Lisp-level functions like
utf7-encode being called...

I don't think this is as simple as any of us thought.  :-)

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen