simple fix to mask command line arguments after they are copied #7122

This replaces the command line args with Xs for bitcoin-cli so that passwords and private keys can not be observed in the process table while it executes. This trick is borrowed from the mysql codebase.

Er. This would prevent me from figuring out which of my daemons was testnet/mainnet/regtest... and still doesn't make it actually secure.

@gmaxwell It's for bitcoin-cli, not bitcoind.

concept ack

I'd rather see any such possibility to enter sensitive information on the command line to be removed. It is not only ps output, but also history etc.

This provides a false sense of security. There is a time window in which the arguments are visible, it may be possible to time this exactly, if not then the brute force 'request the process list in a tight loop' would work to get the credentials at least some of the time (once would be enough.)

Under Linux you can use the hidepid mount option: http://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/ to hide process information (such as command line, environment) between users.

I'd rather see any such possibility to enter sensitive information on the command line to be removed

But it's hard to know what is sensitive information.

At least the walletpassphrase could be asked on the console. This was considered in the past, but surprisingly difficult to do in a platform-independent and secure way. A dependency on GNU readline isn't deemed worth it.

(the possibility to read an argument from an arbitrary file or file descriptor may be useful, though, similar to bitcoin-tx's registers)

(the party line used to be "use the bitrpc python script to enter the passphrase", but this script was unmaintained and doesn't exist anymore as of #6507)

Sigh, yeah, NACK based on false sense of security.

Definitely an issue worth fixing somehow though.

Simplest solution: what about a bitcoin-cli mode that reads the input as a line from stdin instead of the command line?

Giving bitcoin-cli an interactive mode? I like that idea. "bitcoin-cli -i/--interactive" to enable "stdin mode". I think it'd be a nice step for people who rely on bitcoin-cli.

+1 I hate to use bitcoin-cli because you have to type the same stuff all over again in the terminal for every call.

I'm not talking about an interactive mode. Interactive mode is less straightforward to implement, e.g. nice prompt handling, intermediate variables, etc. It would be useful but I think it'd be better to write a different script/application for that, e.g. based on a Python (or Javascript) shell.

No, what I mean is simply to read the input (once) from stdin so a script or user using bitcoin-cli can pipe in the password instead of specifying it on the command line where it can get intercepted.

I understand, +1

Closing this. Opened issue #7442 for the bitcoin-cli from stdin option.