On Thu, Oct 1, 2009 at 4:24 PM, Ger Hobbelt <g...@hobbelt.com> wrote: > A note about your mention of 'security leak': when you are worried > about adversaries who can run 'ps -l' on your machine, then you're > essentially worried about adversaries with plenty of access to your > machine, so they'll quite probably be able to 'cat' that keyfile
Any normal user on a Linux machine would be able to see 'ps -f'. But to 'cat' the keyfile or coredump the app, they would need to either (1) have root access, or (2) have cracked the machine. In my mind there is a large leap between 'normal users could get this secret info' and 'user's with root access could get this secret info'. Michael D. Adams ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org
