I am confused on how I should store passwords in memory while they are
waiting to be used. Obviously the user will not want to type their
password in for every single operation that requires it. How should I
pass the password around?
def store_password
@password = “”
$stdin.sysread(512, @password)}
@memwipe = Thread.new do
Thread.stop #restart at end of operations that require password,
to avoid password being wiped early
sleep(@settings.password_store_time)
wipe = StringIO.new("\0" * @password.bytesize)
wipe.read(@password.bytesize, @password)
$stdin.iflush #wipes keyboard buffer
@password = nil
Thread.exit
end
end
I might put this in my class that requires a password. Fortunately only
one class really requires passwords, so I can just pass through the
entire class with instance variables [hopefully this is an acceptable
time to use instance variables]. I can have methods that start password
store if @password == nil unless :no_password is passed [sometimes users
may not use passwords]. And then at the end of the method they start the
thread.
How can I integrate this with a GUI system though. When @password == nil
the user should be prompted for their password with the GUI when
store_password is called. But how can I determine @password value from
the GUI, would this be an acceptable time to use instance_variable_get
and poll that variable from the GUI? Also $stdin.sysread will work fine
for the CLI interface but I am struggling to think of a way to send the
password from the GUI to the store_password method. I guess I could pass
with def store_password(password) but then I can’t have the @password =
“” and $stdin part because I think it will not be compatible with the
GUI/CLI. Maybe I need to move that part to the CLI class and do it
differently in the GUI class to avoid a conflict there?
Thanks!