Is it insecure to send a password in a `curl` command?












3















Here’s an example request we can make to the GitHub API:



curl 'https://api.github.com/authorizations' --user "USERNAME"


This will prompt for the account password, to continue:



Enter host password for user 'USERNAME':


If we don’t want to get the prompt, we can provide the password at the same time as the username:



curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?










share|improve this question



























    3















    Here’s an example request we can make to the GitHub API:



    curl 'https://api.github.com/authorizations' --user "USERNAME"


    This will prompt for the account password, to continue:



    Enter host password for user 'USERNAME':


    If we don’t want to get the prompt, we can provide the password at the same time as the username:



    curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


    But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?










    share|improve this question

























      3












      3








      3








      Here’s an example request we can make to the GitHub API:



      curl 'https://api.github.com/authorizations' --user "USERNAME"


      This will prompt for the account password, to continue:



      Enter host password for user 'USERNAME':


      If we don’t want to get the prompt, we can provide the password at the same time as the username:



      curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


      But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?










      share|improve this question














      Here’s an example request we can make to the GitHub API:



      curl 'https://api.github.com/authorizations' --user "USERNAME"


      This will prompt for the account password, to continue:



      Enter host password for user 'USERNAME':


      If we don’t want to get the prompt, we can provide the password at the same time as the username:



      curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"


      But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?







      macosx curl






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 6 hours ago









      user137369user137369

      1505




      1505






















          2 Answers
          2






          active

          oldest

          votes


















          6














          Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS. Locally this might be less secure, because the password gets saved to the command history (~/.bash_history) as a part of the command.






          share|improve this answer



















          • 3





            And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

            – dave_thompson_085
            1 hour ago











          • Excellent addition, Dave!

            – Esa Jokinen
            1 hour ago



















          0














          No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



          But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



          TCPDUMP



          [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


          TSHARK



          [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





          share|improve this answer

























            Your Answer








            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "162"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            noCode: true, onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205479%2fis-it-insecure-to-send-a-password-in-a-curl-command%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            6














            Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS. Locally this might be less secure, because the password gets saved to the command history (~/.bash_history) as a part of the command.






            share|improve this answer



















            • 3





              And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

              – dave_thompson_085
              1 hour ago











            • Excellent addition, Dave!

              – Esa Jokinen
              1 hour ago
















            6














            Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS. Locally this might be less secure, because the password gets saved to the command history (~/.bash_history) as a part of the command.






            share|improve this answer



















            • 3





              And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

              – dave_thompson_085
              1 hour ago











            • Excellent addition, Dave!

              – Esa Jokinen
              1 hour ago














            6












            6








            6







            Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS. Locally this might be less secure, because the password gets saved to the command history (~/.bash_history) as a part of the command.






            share|improve this answer













            Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS. Locally this might be less secure, because the password gets saved to the command history (~/.bash_history) as a part of the command.







            share|improve this answer












            share|improve this answer



            share|improve this answer










            answered 5 hours ago









            Esa JokinenEsa Jokinen

            2,589817




            2,589817








            • 3





              And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

              – dave_thompson_085
              1 hour ago











            • Excellent addition, Dave!

              – Esa Jokinen
              1 hour ago














            • 3





              And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

              – dave_thompson_085
              1 hour ago











            • Excellent addition, Dave!

              – Esa Jokinen
              1 hour ago








            3




            3





            And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

            – dave_thompson_085
            1 hour ago





            And if on a shared system, it will usually be visible to others in ps and top and such, or by reading /proc/$pid/cmdline

            – dave_thompson_085
            1 hour ago













            Excellent addition, Dave!

            – Esa Jokinen
            1 hour ago





            Excellent addition, Dave!

            – Esa Jokinen
            1 hour ago













            0














            No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



            But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



            TCPDUMP



            [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


            TSHARK



            [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





            share|improve this answer






























              0














              No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



              But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



              TCPDUMP



              [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


              TSHARK



              [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





              share|improve this answer




























                0












                0








                0







                No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



                But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



                TCPDUMP



                [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


                TSHARK



                [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x





                share|improve this answer















                No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.



                But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,



                TCPDUMP



                [root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX


                TSHARK



                [root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x






                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited 2 hours ago

























                answered 2 hours ago









                MuhammadMuhammad

                675618




                675618






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Information Security Stack Exchange!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f205479%2fis-it-insecure-to-send-a-password-in-a-curl-command%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Loup dans la culture

                    How to solve the problem of ntp “Unable to contact time server” from KDE?

                    ASUS Zenbook UX433/UX333 — Configure Touchpad-embedded numpad on Linux