Is it insecure to send a password in a `curl` command?Self-signed certificates and internal cURL requestsPHP get_file_contents & curlIs it safe to use .netrc files to store credentials for tools like curl or ftp?Is it possible to send a cURL request with SSL without the private key?Are there risks to allowing cURL from my machine?Unable to utilise curl commands on websiteExtra secure layer to cURL callsHow curl provided source code that the browser did not?Leveraging curl to spawn a shellCan cURL block a rogue CA?

Do I need to be arrogant to get ahead?

A Ri-diddley-iley Riddle

How to generate binary array whose elements with values 1 are randomly drawn

Knife as defense against stray dogs

Is it normal that my co-workers at a fitness company criticize my food choices?

Could this Scherzo by Beethoven be considered to be a fugue?

What are substitutions for coconut in curry?

What is the plural TO OF sth

Should Stotras and Mantras be recited aloud?

What exactly is this small puffer fish doing and how did it manage to accomplish such a feat?

Why is a white electrical wire connected to 2 black wires?

How to explain that I do not want to visit a country due to personal safety concern?

Unnormalized Log Probability - RNN

What is the relationship between relativity and the Doppler effect?

World War I as a war of liberals against authoritarians?

How to make healing in an exploration game interesting

Should I use acronyms in dialogues before telling the readers what it stands for in fiction?

Running file with some extension

Difference between 'dont avoir besoin' and 'en avoir besoin'

What can I do if I am asked to learn different programming languages very frequently?

Is it true that good novels will automatically sell themselves on Amazon (and so on) and there is no need for one to waste time promoting?

Do ranged attacks with improvised weapons get the bonus from the archery fighting style?

Why does a Star of David appear at a rally with Francisco Franco?

What is signal ground



Is it insecure to send a password in a `curl` command?


Self-signed certificates and internal cURL requestsPHP get_file_contents & curlIs it safe to use .netrc files to store credentials for tools like curl or ftp?Is it possible to send a cURL request with SSL without the private key?Are there risks to allowing cURL from my machine?Unable to utilise curl commands on websiteExtra secure layer to cURL callsHow curl provided source code that the browser did not?Leveraging curl to spawn a shellCan cURL block a rogue CA?













12















Here’s an example request we can make to the GitHub API:



curl 'https://api.github.com/authorizations' --user "USERNAME"


This will prompt for the account password, to continue:



Enter host password for user 'USERNAME':


If we don’t want to get the prompt, we can provide the password at the same time as the username:



curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?










share|improve this question


























    12















    Here’s an example request we can make to the GitHub API:



    curl 'https://api.github.com/authorizations' --user "USERNAME"


    This will prompt for the account password, to continue:



    Enter host password for user 'USERNAME':


    If we don’t want to get the prompt, we can provide the password at the same time as the username:



    curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


    But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?










    share|improve this question
























      12












      12








      12


      2






      Here’s an example request we can make to the GitHub API:



      curl 'https://api.github.com/authorizations' --user "USERNAME"


      This will prompt for the account password, to continue:



      Enter host password for user 'USERNAME':


      If we don’t want to get the prompt, we can provide the password at the same time as the username:



      curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


      But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?










      share|improve this question














      Here’s an example request we can make to the GitHub API:



      curl 'https://api.github.com/authorizations' --user "USERNAME"


      This will prompt for the account password, to continue:



      Enter host password for user 'USERNAME':


      If we don’t want to get the prompt, we can provide the password at the same time as the username:



      curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


      But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?







      macosx curl






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked yesterday









      user137369user137369

      2007




      2007




















          3 Answers
          3






          active

          oldest

          votes


















          32














          Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



          Locally this might be less secure, because:



          • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

          • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

          • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.





          share|improve this answer




















          • 19





            And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

            – dave_thompson_085
            yesterday






          • 1





            Excellent addition, Dave!

            – Esa Jokinen
            yesterday






          • 1





            Then you must keep the script in a safe place. I'd recommend 700 permissions.

            – Esa Jokinen
            yesterday






          • 3





            to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

            – Anticom
            yesterday






          • 6





            This doesn't solve the /proc/$pid/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

            – Stephen Touset
            22 hours ago


















          3














          No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



          But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



          TCPDUMP



          [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


          TSHARK



          [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





          share|improve this answer
































            1














            The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.






            share|improve this answer






















              Your Answer








              StackExchange.ready(function()
              var channelOptions =
              tags: "".split(" "),
              id: "162"
              ;
              initTagRenderer("".split(" "), "".split(" "), channelOptions);

              StackExchange.using("externalEditor", function()
              // Have to fire editor after snippets, if snippets enabled
              if (StackExchange.settings.snippets.snippetsEnabled)
              StackExchange.using("snippets", function()
              createEditor();
              );

              else
              createEditor();

              );

              function createEditor()
              StackExchange.prepareEditor(
              heartbeatType: 'answer',
              autoActivateHeartbeat: false,
              convertImagesToLinks: false,
              noModals: true,
              showLowRepImageUploadWarning: true,
              reputationToPostImages: null,
              bindNavPrevention: true,
              postfix: "",
              imageUploader:
              brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
              contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
              allowUrls: true
              ,
              noCode: true, onDemand: true,
              discardSelector: ".discard-answer"
              ,immediatelyShowMarkdownHelp:true
              );



              );













              draft saved

              draft discarded


















              StackExchange.ready(
              function ()
              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205479%2fis-it-insecure-to-send-a-password-in-a-curl-command%23new-answer', 'question_page');

              );

              Post as a guest















              Required, but never shown

























              3 Answers
              3






              active

              oldest

              votes








              3 Answers
              3






              active

              oldest

              votes









              active

              oldest

              votes






              active

              oldest

              votes









              32














              Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



              Locally this might be less secure, because:



              • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

              • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

              • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.





              share|improve this answer




















              • 19





                And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

                – dave_thompson_085
                yesterday






              • 1





                Excellent addition, Dave!

                – Esa Jokinen
                yesterday






              • 1





                Then you must keep the script in a safe place. I'd recommend 700 permissions.

                – Esa Jokinen
                yesterday






              • 3





                to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

                – Anticom
                yesterday






              • 6





                This doesn't solve the /proc/$pid/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

                – Stephen Touset
                22 hours ago















              32














              Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



              Locally this might be less secure, because:



              • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

              • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

              • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.





              share|improve this answer




















              • 19





                And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

                – dave_thompson_085
                yesterday






              • 1





                Excellent addition, Dave!

                – Esa Jokinen
                yesterday






              • 1





                Then you must keep the script in a safe place. I'd recommend 700 permissions.

                – Esa Jokinen
                yesterday






              • 3





                to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

                – Anticom
                yesterday






              • 6





                This doesn't solve the /proc/$pid/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

                – Stephen Touset
                22 hours ago













              32












              32








              32







              Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



              Locally this might be less secure, because:



              • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

              • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

              • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.





              share|improve this answer















              Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.



              Locally this might be less secure, because:



              • The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.

              • On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.

              • Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.






              share|improve this answer














              share|improve this answer



              share|improve this answer








              edited 17 hours ago

























              answered yesterday









              Esa JokinenEsa Jokinen

              2,8541019




              2,8541019







              • 19





                And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

                – dave_thompson_085
                yesterday






              • 1





                Excellent addition, Dave!

                – Esa Jokinen
                yesterday






              • 1





                Then you must keep the script in a safe place. I'd recommend 700 permissions.

                – Esa Jokinen
                yesterday






              • 3





                to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

                – Anticom
                yesterday






              • 6





                This doesn't solve the /proc/$pid/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

                – Stephen Touset
                22 hours ago












              • 19





                And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

                – dave_thompson_085
                yesterday






              • 1





                Excellent addition, Dave!

                – Esa Jokinen
                yesterday






              • 1





                Then you must keep the script in a safe place. I'd recommend 700 permissions.

                – Esa Jokinen
                yesterday






              • 3





                to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

                – Anticom
                yesterday






              • 6





                This doesn't solve the /proc/$pid/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

                – Stephen Touset
                22 hours ago







              19




              19





              And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

              – dave_thompson_085
              yesterday





              And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

              – dave_thompson_085
              yesterday




              1




              1





              Excellent addition, Dave!

              – Esa Jokinen
              yesterday





              Excellent addition, Dave!

              – Esa Jokinen
              yesterday




              1




              1





              Then you must keep the script in a safe place. I'd recommend 700 permissions.

              – Esa Jokinen
              yesterday





              Then you must keep the script in a safe place. I'd recommend 700 permissions.

              – Esa Jokinen
              yesterday




              3




              3





              to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

              – Anticom
              yesterday





              to solve the issue with .bash_history you could just prepend a space in front of your command. This way it doesn't get saved to history. (further info over here: unix.stackexchange.com/questions/115917/… )

              – Anticom
              yesterday




              6




              6





              This doesn't solve the /proc/$pid/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

              – Stephen Touset
              22 hours ago





              This doesn't solve the /proc/$pid/cmdline issue (e.g., it showing up in ps output). If there are multiple users on a system, this is a great way to accidentally disclose a password.

              – Stephen Touset
              22 hours ago













              3














              No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



              But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



              TCPDUMP



              [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


              TSHARK



              [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





              share|improve this answer





























                3














                No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



                But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



                TCPDUMP



                [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


                TSHARK



                [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





                share|improve this answer



























                  3












                  3








                  3







                  No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



                  But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



                  TCPDUMP



                  [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


                  TSHARK



                  [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





                  share|improve this answer















                  No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



                  But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



                  TCPDUMP



                  [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


                  TSHARK



                  [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x






                  share|improve this answer














                  share|improve this answer



                  share|improve this answer








                  edited yesterday

























                  answered yesterday









                  MuhammadMuhammad

                  705618




                  705618





















                      1














                      The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.






                      share|improve this answer



























                        1














                        The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.






                        share|improve this answer

























                          1












                          1








                          1







                          The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.






                          share|improve this answer













                          The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.







                          share|improve this answer












                          share|improve this answer



                          share|improve this answer










                          answered 22 hours ago









                          sitaramsitaram

                          592




                          592



























                              draft saved

                              draft discarded
















































                              Thanks for contributing an answer to Information Security Stack Exchange!


                              • Please be sure to answer the question. Provide details and share your research!

                              But avoid


                              • Asking for help, clarification, or responding to other answers.

                              • Making statements based on opinion; back them up with references or personal experience.

                              To learn more, see our tips on writing great answers.




                              draft saved


                              draft discarded














                              StackExchange.ready(
                              function ()
                              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205479%2fis-it-insecure-to-send-a-password-in-a-curl-command%23new-answer', 'question_page');

                              );

                              Post as a guest















                              Required, but never shown





















































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown

































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown







                              Popular posts from this blog

                              He _____ here since 1970 . Answer needed [closed]What does “since he was so high” mean?Meaning of “catch birds for”?How do I ensure “since” takes the meaning I want?“Who cares here” meaningWhat does “right round toward” mean?the time tense (had now been detected)What does the phrase “ring around the roses” mean here?Correct usage of “visited upon”Meaning of “foiled rail sabotage bid”It was the third time I had gone to Rome or It is the third time I had been to Rome

                              Bunad

                              Færeyskur hestur Heimild | Tengill | Tilvísanir | LeiðsagnarvalRossið - síða um færeyska hrossið á færeyskuGott ár hjá færeyska hestinum