view-lossage and passwords

view-lossage and passwords

[mandar.mitra]

At various times (e.g. when I am using a terminal) within emacs, I
need to enter my password. This is, by default, stored in my typing
history, and becomes visible with view-lossage. Is there some way to
prevent passwords from being recorded in typing history, so that if I
run view-lossage (usually accidentally), my password won't show up on
screen?

I've looked around on the web a bit, but didn't find anything that
addresses this. Thanks for any tips,
Mandar.

Re: view-lossage and passwords

[Andreas Röhler]

mandar.mitra wrote:
> At various times (e.g. when I am using a terminal) within emacs, I
> need to enter my password. This is, by default, stored in my typing
> history, and becomes visible with view-lossage. Is there some way to
> prevent passwords from being recorded in typing history, so that if I
> run view-lossage (usually accidentally), my password won't show up on
> screen?
> 
> I've looked around on the web a bit, but didn't find anything that
> addresses this. Thanks for any tips,
> Mandar.
> 

Hi,

that's a bug and security risk IMO. It should never happen.

Please report it: M-x report-emacs-bug

Thanks


Andreas

--
https://code.launchpad.net/~a-roehler/python-mode
https://code.launchpad.net/s-x-emacs-werkstatt/

Re: view-lossage and passwords

[Geralt]

Hi,

I just used Emacs built-in bug-reporting facility (M-x
report-emacs-bug RET) and among some other information this includes
the lossage, so if passwords are included in the lossage this is
definitely a security bug. I just tried that with Emacs 23.1.1 and I
can't confirm that bug, it looks like the lossage is flushed after the
password prompt finishes.



Geralt.

Re: view-lossage and passwords

[Andreas Röhler]

Geralt wrote:
> Hi,
> 
> I just used Emacs built-in bug-reporting facility (M-x
> report-emacs-bug RET) and among some other information this includes
> the lossage, so if passwords are included in the lossage this is
> definitely a security bug. I just tried that with Emacs 23.1.1 and I
> can't confirm that bug, it looks like the lossage is flushed after the
> password prompt finishes.
> 
> 
> 
> Geralt.
> 


Hi,

it's not flushed in a similar case with

In GNU Emacs 23.1.92.1 (i686-pc-linux-gnu, GTK+ Version 2.12.0)
 of 2010-02-19

filed a bug report meanwhile:

http://debbugs.gnu.org/cgi/bugreport.cgi?bug=5664

Andreas

--
https://code.launchpad.net/~a-roehler/python-mode
https://code.launchpad.net/s-x-emacs-werkstatt/