[MNG-4928] mvn --encrypt-master-password is insecure

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 2.2.1, 3.0, 3.0.1
• Component/s: Command Line
• Assignee: Brett Porter
• Reporter: Gregory John Wilkins
• Created: 08/Dec/10 05:40
• Updated: 08/Dec/10 06:48
• Resolved: 08/Dec/10 06:48

Description

gregw@Brick: ~
[506] mvn --encrypt-master-password something-very-very-secret

{zfC2klZItekHCPGwE+R0JZ2+RjyDlqxP343ThV0R3B5taWEHbI5t+QGfXOZ0mq9j}

gregw@Brick: ~
[507] history 2
506 mvn --encrypt-master-password something-very-very-secret
507 history 2

commands that take passwords should not accept them from the command line, as they are then visible in history and even in some PS output. They should prompt for passwords with echo turned off.

Issue Links

• duplicates: MNG-4099 Password encryption CLI switches should prompt for password if missing