torios team mailing list archive

[Nio Wiklund <nio.wiklund@xxxxxxxxx>]

Hi Jack and Israel,

I think it is OK to store that variable in memory as a variable in the
live session. It should not be stored in a disk afterwards.

But if the OBI is run from an installed system, it is a worse case.

An alternative is to wipe that variable after using it, to overwrite it
with something, for example zeros, or better, with 64 random bytes.

Best regards
Nio

Den 2015-03-08 22:07, Israel skrev:
> Hi  Jack,
> you are very correct, however that would mean storing the password in
> memory in a variable, rather than passing it quickly on.
> I suppose I could revert it to give the double password prompt.
> You are correct though... the user may type it in wrong, and be stuck...
> There may be a good way to test it... maybe chroot in as the new user
> and make sure the password works.... if it fails, start over.
> i'll think over this some more...
> 
> On 03/08/2015 03:20 PM, Cinque Port Computers wrote:
>> Hi Israel,
>>
>> When asked to add new user, I only noticed asking for password once. 
>> Is it not good practice to ask again to re-enter for accuracy?
>>
>> JackT.
>>
>>
>>
>> > Date: Sun, 8 Mar 2015 08:01:01 -0500
>> > From: israel@xxxxxxxxxx
>> > To: torios@xxxxxxxxxxxxxxxxxxx
>> > Subject: [Torios] ToriOS ISO
>> >
>> > Hi everyone,
>> > please re-zsync your ISO.
>> > This one has the rebuilt base, and some improvements to OBI.
>> >
>> > Many bugs are fixed in this build. Please test for the bugs you have
>> > reported.
>> > It is getting very close to being ready for release! Thanks everyone
>> > fore testing!!!
>> >
>> > --
>> > Regards
>> >
>> > -Israel
>> > ToriOS Team
>> >
>> >
>> > --
>> > Mailing list: https://launchpad.net/~torios
>> > Post to : torios@xxxxxxxxxxxxxxxxxxx
>> > Unsubscribe : https://launchpad.net/~torios
>> > More help : https://help.launchpad.net/ListHelp
> 
> 
> -- 
> Regards
> 
> -Israel
> ToriOS Team
> 
> 
>