Some applications allow to pass password as an argument. For example:mysql --user=user_name --password=your_password db_nameIs it safe? Besides the fact that typed password would be saved in bash history, someone can type w command in the appropriate moment and will see the full command line of process (including password).It's quite surprising for me that every user can see what command I'm currently executing.
Is w command safe for users?
command line;security;password
The command line arguments of every process in the system is considered public. Not just the w command, but ps and top and many other commands access that information as a matter of course. Indeed no special privileges are required to get that information. On Linux, you can read the command line of another process, even a process belonging to another user, by reading /proc/<pid>/cmdline.This is not a flaw or unsafe behaviour on the part of w or top or ps (or cat). Rather, the onus is on the side of not passing sensitive information on command lines on multi-user systems, ever.Most utilities that have the ability to accept passwords on the command line document that it's not recommended to do it. For example, from mysql's manpage:Specifying a password on the command line should be considered insecure. See Section 5.3.2.2, End-User Guidelines for Password Security. You can use an option file to avoid giving the password on the command line.By the way, passing passwords or sensitive data in environment variables is less blatantly unsafe, but is also actually unsafe on most systems.