badfish accepts secrets as command line arguments #496
Description
badfish currently takes secrets via command line arguments.
That includes the argument to the -p, --new-password, --old-password options at least (-p being a required option).
On most systems, command line arguments are public information and expected to be. They show in the output of ps or equivalent, end up in shell history files or audit logs (often forwarded to other systems), etc.
Passing secrets on the command line is very poor security practice.
AFAICT, badfish currently doesn't provide any safe alternative way to pass authentication credentials.
Safer and relatively portable ways to pass credentials include environment variables (like sshpass -e, openssl's -pass env:var), files (like the -pass file:path of openssl things like .netrc or curl/mysql conf files) or file descriptors (such as stdin or openssl's -pass fd:n), env vars being the easiest.
As a work around, for now, one can redefine badfish as:
#! /path/to/badfish-venv/bin/python3 --
import sys, os
from badfish.main import main
sys.argv += ['-u', os.getenv('BADFISH_USER'), '-p', os.getenv('BADFISH_PASSWORD')]
sys.exit(main())
But it would be much better if badfish itself provided with better ways to pass credentials and make it clear that -p (and other options that take secrets) is unsafe and should not be used.