I like how you redacted the target but not the password – though I’m pretty sure the real password is alphanumeric and based on a family member: http://www.bash.org/?quote=244321
One of the actual big-P Passwords decades ago was actually
0000000
> during the height of the Cold War, the US military put such an emphasis on a rapid response to an attack on American soil, that to minimize any foreseeable delay in launching a nuclear missile, for nearly two decades they intentionally set the launch codes at every silo in the US to 8 zeroes
Wow! From an InfoSec perspective, that’s hard to believe but when you understand that every large group of humans has competing interests and large bureaucracies don’t have perfect chains of command, it’s totally believable. I guess it’s a high-stakes example of the difficulty in getting the right balance between security and convenience.
Edit: on a related note, a few years ago I was shocked to hear the story of how a simple accident while carrying out routine maintenance of liquid-fuelled nuclear missiles almost resulted in a devastating nuclear explosion in the American heartland: https://www.thisamericanlife.org/634/human-error-in-volatile...
It's also visible in the process table (ps auxww). It can be erased by rewriting the arguments from inside the process (I think this is OS-specific, not the same as changing argv in-place), but that is a race condition.
The safe way is to either read it from stdin/fd (maybe call isatty(3) to check if someone doesn't echo password | ./foo), or open a file (check if permissions are 600). You could also have a named socket (check permissions!) talking to an authn agent, which could be doing some other fancy stuff like pinging your smartwatch to confirm, etc.
where the gpg key has a password and is stored on a hardware dongle that doesn't allow copying the private key off. If you really want to be fancy, there are some hardware security keys that also require a biometric to confirm.
The other option is something like Hasicorp Vault, but we're way out of "one line bash" territory :p
