S-Cache
Security and privacy
secret storage
SHOW HN2020
51points
8comments
#1,058of 3,028 in 2020
Top 35%of 2020 by points
How HN took it
CuriousMostly questions and neutral comments
0 positive, 4 neutral or asking, 0 mixed, 2 critical, out of 6 comments about the project. Thread score -0.25.
Execution: 0 for, 1 againstDesign: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
Objections
Setuid C code has security flaws: HOME env trust, stat/fopen symlink risk, unsanitized popen
From 1 comment
The mention of setuid thing for storing personal secrets seemed a little odd, so I looked at the code. It seems the only thing that has been updated recently is the README and…
mgerdts on HN
Shadow file comparison is questionable since shadow stores hashes, not raw secrets
From 1 comment
Not sure how I feel about the comparison to the shadow passwords file -- the shadow file doesn't contain the raw password, but a hashed version. If someone steals the shadow…
mothershipper on HN
Requests
Use secure C practices and sanitize environment before subprocesses
From 2 comments
The mention of setuid thing for storing personal secrets seemed a little odd, so I looked at the code. It seems the only thing that has been updated recently is the README and…
mgerdts on HNIt’s been a few years since I’ve used GCC, but I believe you’ll want to compile with security flags (e.g. -fPIE -fstack-protector and friends)
catlifeonmars on HN
Questions
Why compare to the shadow passwords file
From 2 comments
Not sure how I feel about the comparison to the shadow passwords file -- the shadow file doesn't contain the raw password, but a hashed version. If someone steals the shadow…
mothershipper on HNI'm a little confused here. The author compares S-Cache to 'sudo'. 'sudo' is a command that lets an unprivileged user run a privileged command. S-Cache lets a process access a…
blendergeek on HN
Alternatives named
GNOME Keyring
From 1 comment
As you might imagine, there is some prior art in this space. In broadly portable Unix userspace, there is GNOME Keyring. It takes special caution to pin secrets in memory…
loeg on HN
Linux keyctl
From 1 comment
As you might imagine, there is some prior art in this space. In broadly portable Unix userspace, there is GNOME Keyring. It takes special caution to pin secrets in memory…
loeg on HN
macOS Keychain
From 1 comment
As you might imagine, there is some prior art in this space. In broadly portable Unix userspace, there is GNOME Keyring. It takes special caution to pin secrets in memory…
loeg on HN
Windows CryptProtectData
From 1 comment
As you might imagine, there is some prior art in this space. In broadly portable Unix userspace, there is GNOME Keyring. It takes special caution to pin secrets in memory…
loeg on HN