Securely Erasing Password in Memory (Python)

by

Python doesn’t have that low of a level of control over memory. Accept it, and move on. The best you can do is to del password after calling mail.login so that no references to the password string object remain. Any solution that purports to be able to do more than that is only giving you a false sense of security.

Python string objects are immutable; there’s no direct way to change the contents of a string after it is created. Even if you were able to somehow overwrite the contents of the string referred to by password (which is technically possible with stupid ctypes tricks), there would still be other copies of the password that have been created in various string operations:

  • by the getpass module when it strips the trailing newline off of the inputted password
  • by the imaplib module when it quotes the password and then creates the complete IMAP command before passing it off to the socket

You would somehow have to get references to all of those strings and overwrite their memory as well.

More Related Contents:

  1. Mark data as sensitive in python
  2. Why is sudo not accepting my sudo password? [closed]
  3. What are the risks of running ‘sudo pip’?
  4. Security of Python’s eval() on untrusted strings?
  5. Getting a hidden password input
  6. I need to securely store a username and password in Python, what are my options? [closed]
  7. Simple way to encode a string according to a password?
  8. hash function in Python 3.3 returns different results between sessions
  9. Is distributing python source code in Docker secure?
  10. Salt and hash a password in Python
  11. Masking user input in python with asterisks
  12. Hiding a password in a python script (insecure obfuscation only)
  13. Validation of a Password – Python
  14. Generate password in python
  15. Change to sudo user within a python script
  16. How to open a password protected excel file using python?
  17. Read password from stdin [duplicate]
  18. How to have password echoed as asterisks [duplicate]
  19. Python 3, Are there any known security holes in ast.literal_eval(node_or_string)?
  20. Is a SQLAlchemy query vulnerable to injection attacks?
  21. Is this Python code vulnerable to SQL injection? (SQLite3)
  22. Create a temporary FIFO (named pipe) in Python?
  23. Securely storing passwords for use in python script [duplicate]
  24. How do I use the built in password reset/change views with my own templates
  25. Encrypted and secure docker containers
  26. Google Authenticator implementation in Python
  27. Do CSRF attacks apply to API’s?
  28. What’s the purpose of Django setting ‘SECRET_KEY’?
  29. sort and swap in python same time
  30. why can’t I change only a single element in a nested list in Python [duplicate]

Leave a Comment