[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: opaque data types
From: |
Ted Zlatanov |
Subject: |
Re: opaque data types |
Date: |
Fri, 07 Jun 2013 12:01:59 -0400 |
User-agent: |
Gnus/5.130006 (Ma Gnus v0.6) Emacs/24.3.50 (gnu/linux) |
On Fri, 7 Jun 2013 16:44:18 +0100 (BST) Christopher Schmidt <address@hidden>
wrote:
CS> Ted Zlatanov <address@hidden> writes:
>> To store passwords and other sensitive data in a way so they are not
>> trivial to extract. We've had some previous emacs-devel discussions
>> about this.
CS> Can you please point me to the discussion?
At least some of it was covered in the thread around
http://lists.gnu.org/archive/html/emacs-devel/2012-01/msg00407.html
CS> Considering we are talking about a regular userspace application with no
CS> distributed components I do not see any advantage at all by encrypting
CS> passwords in memory. How does interposing a function to extract
CS> passwords from a new inbuild type increase security at all?
By making it less trivial to extract them. The opaque type makes it
possible to change the implementation if better ways are available on a
platform, e.g. the Mac OS X keychain or the Secrets API or the W32
keychain. The fallback mechanism can at least make it a little harder
to get someone's passwords.
CS> Who's your attacker anyway?
Do we have to do risk assessments too?
Ted
- Re: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!), (continued)
- Re: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!), Stefan Monnier, 2013/06/05
- RE: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!), Drew Adams, 2013/06/05
- Re: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!), Ted Zlatanov, 2013/06/05
- Re: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!), Stephen J. Turnbull, 2013/06/06
- Re: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!), Ted Zlatanov, 2013/06/06
- Re: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!), Stephen J. Turnbull, 2013/06/06
- opaque data types (was: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!)), Ted Zlatanov, 2013/06/07
- Re: opaque data types, Christopher Schmidt, 2013/06/07
- Re: opaque data types, Ted Zlatanov, 2013/06/07
- Re: opaque data types, Christopher Schmidt, 2013/06/07
- Re: opaque data types,
Ted Zlatanov <=
- Re: opaque data types, Christopher Schmidt, 2013/06/08
- Re: opaque data types, Ted Zlatanov, 2013/06/09
- Re: opaque data types, Stefan Monnier, 2013/06/07
- Re: opaque data types, Ted Zlatanov, 2013/06/07
- opaque data types, Stephen J. Turnbull, 2013/06/08
- opaque data types [revise and resend], Stephen J. Turnbull, 2013/06/08
- Re: opaque data types [revise and resend], Ted Zlatanov, 2013/06/10
Re: plist-based package.el (was Re: cl-defstruct-based package.el, now with ert tests and no external tar!), Stefan Monnier, 2013/06/04