What key do you use to encrypt and decrypt the password in the config file? Something hard-coded in the application? That'll be easy to extract, e.g. by single-stepping the binary.
It's also worth mentioning: with many filesystems, when you overwrite a file, garbage blocks containing the old file (and hence the cleartext passphrase) remain on the system. This will be true for pretty much any filesystem if you decide to do an atomic overwrite of the config file by writing out a new file, and then renaming it to replace the old file. The directory entry is updated to point to the new file, but the blocks which contain the old file remain until they are re-used at some indeterminate time in the future. -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/9308764c-e19c-4888-926f-948956185ac0o%40googlegroups.com.
