Skip to content

Conversation

@jjttjj
Copy link
Member

@jjttjj jjttjj commented May 2, 2024

This adds a macro force-plaintext-read, which forces the password to be read via read-line.

The motivation for this is remote repls. If I'm connected to a remote repl and try to decrypt my secrets, it will attempt to read the password from console or swing on the host, which might not be available or convenient.

I'm not 100% sure that it's a good idea to encourage decrypting remotely in the first place, it would require one to be aware of the security implications of however the password is sent to the server.

There are probably some alternative options to somehow use with-password instead.

For what it's worth, I use inf-clojure in emacs mode which wraps comint mode, which has a feature to automatically prompt a user for password without echoing when sees printed any output that looks like a password prompt, which works out of the box with the Secrets read-line password reader. I'm not sure if this is a common thing in other tooling. But if I didn't happen to have no-echo for my password input in these situations, I probably wouldn't have thought to add this as a feature, which might be a hint it's a bad idea in the library.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants