From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1JOFZj-0002L7-85 for mharc-grub-devel@gnu.org; Sun, 10 Feb 2008 12:02:43 -0500 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1JOFZh-0002JA-Ue for grub-devel@gnu.org; Sun, 10 Feb 2008 12:02:42 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1JOFZh-0002Hx-39 for grub-devel@gnu.org; Sun, 10 Feb 2008 12:02:41 -0500 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1JOFZf-0002He-Nm for grub-devel@gnu.org; Sun, 10 Feb 2008 12:02:40 -0500 Received: from aybabtu.com ([69.60.117.155]) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1JOFZf-0001bd-Ft for grub-devel@gnu.org; Sun, 10 Feb 2008 12:02:39 -0500 Received: from [192.168.10.6] (helo=thorin) by aybabtu.com with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1JOFZQ-0003IB-B1 for grub-devel@gnu.org; Sun, 10 Feb 2008 18:02:30 +0100 Received: from rmh by thorin with local (Exim 4.63) (envelope-from ) id 1JOFXW-0003OP-JT for grub-devel@gnu.org; Sun, 10 Feb 2008 18:00:26 +0100 Date: Sun, 10 Feb 2008 18:00:26 +0100 From: Robert Millan To: The development of GRUB 2 Message-ID: <20080210170026.GA12941@thorin> References: <20080210131656.GA4168@thorin> <47AF0282.4000307@isaac.cedarswampstudios.org> <20080210152226.GB7404@thorin> <47AF293F.8070804@isaac.cedarswampstudios.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <47AF293F.8070804@isaac.cedarswampstudios.org> Organization: free as in freedom X-Message-Flag: Worried about Outlook viruses? Switch to Thunderbird! www.mozilla.com/thunderbird X-Debbugs-No-Ack: true User-Agent: Mutt/1.5.13 (2006-08-11) X-detected-kernel: by monty-python.gnu.org: Genre and OS details not recognized. Subject: Re: [PATCH] read --echo=[yes|no|wildcard] X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Feb 2008 17:02:42 -0000 On Sun, Feb 10, 2008 at 11:41:35AM -0500, Isaac Dupree wrote: > Robert Millan wrote: > >On Sun, Feb 10, 2008 at 08:56:18AM -0500, Isaac Dupree wrote: > >>Robert Millan wrote: > >>>Adds a parameter to define echoing behaviour in read. Then one can use > >>>--echo=no or --echo=wildcard to make it suitable for reading passwords. > >>I wonder how suitable it is for passwords -- is the memory always erased > >>before jumping to e.g. Linux? (and is it important to hide it from the > >>prying eyes of the root system? Probably...) > > > >Why? This suggests that the Linux image you just booted is not trusted, > >which > >I find a bit strange. > > well, suppose it runs for a few months, doesn't happen to overwrite that > memory, and then someone hacks in and gets root access (unpatched > security flaws can happen) and then reads the raw memory. Then the > local boot **and the password itself** might be unknowingly compromised > (rather than just probably a hash of the password). (plus you might be > booting Windows ^_^, or anything really.) It's generally good practice, > I think... that GnuPG tries to do, for example? (I could be remembering > wrong) I think that it'd be better to just erase all our environment in grub_machine_fini() or a similar routine, than to give read specific knowledge that its data needs this kind of special protection. Besides, it wouldn't be that simple since the data is controlled by the user via grub.cfg, not directly by GRUB. Anyway, untill we support hashing this doesn't provide any additional security, since you can get the same from grub.cfg ;-) -- Robert Millan I know my rights; I want my phone call! What use is a phone call… if you are unable to speak? (as seen on /.)