Re: securely getting the user's password

2008-03-08 Thread Paul Rubin
Chick <[EMAIL PROTECTED]> writes: > So I guess it is not possible in pure Python to lock the memory from > being swaped? Even if you can lock the memory, python strings are immutable and can be copied around by the runtime system at any time. You're better off using the C API to encapsulate the p

Re: securely getting the user's password

2008-03-08 Thread Chick
> But a far bigger security hole is that the password is sitting there in > your securePass variable in plain text. What are you doing about that? Precisely why I though to use wipe() that way. The password is there in plain text as long as it has to and then one call of securePass.wipe() and its

Re: securely getting the user's password

2008-03-08 Thread Paul Rubin
Chick <[EMAIL PROTECTED]> writes: > I'm writing a security tool which requies wiping off the memory of > certain string after being used, which I've done by implementing it as > a mutable list as follow: You really can't do that reliably in Python and for that matter you can't really do it reliabl

Re: securely getting the user's password

2008-03-08 Thread Steven D'Aprano
On Sat, 08 Mar 2008 18:50:30 -0800, Chick wrote: > Hello, > > I'm writing a security tool Oh good, just what we need, beginners writing security tools. > which requies wiping off the memory of > certain string after being used, which I've done by implementing it as a > mutable list as follow:

securely getting the user's password

2008-03-08 Thread Chick
Hello, I'm writing a security tool which requies wiping off the memory of certain string after being used, which I've done by implementing it as a mutable list as follow: class secureStr: def __init__(self, str): self.__s = [] for i in range(len(str)): self.s += st