Page 1 of 1

Is command history secure?

Posted: Mon 06 Nov, 2017 11:36
by ph0enix
Hello,

I have multiple user accounts on my PC. Under one of these accounts I have issued commands, containing sensitive information (passwords). I tried logging in under different account and Far does not display sensitive commands.

But I wonder how Far stores command history? Is it possible that someone can acquire command history from hard drive itself? Or by logging in as a different user and analyzing Far directory on the drive?

Thanks!

Is command history secure?

Posted: Mon 06 Nov, 2017 11:50
by DrKnS
It is stored in your local profile directory unencrypted, i.e. it is as safe as your whole profile and could be retrieved by any other user with administrative privileges or directly from the hard drive under another operating system.
You would need some external encryption to truly protect your data.

Is command history secure?

Posted: Mon 06 Nov, 2017 12:07
by HaRT
ph0enix, FAR stores all its own histories in the history.db SQLite database in its local profile directory. To protect the stored commands, you may wish to set the Encrypted attribute of the file (caveat: you'll lose the data if you forget your password).

Is command history secure?

Posted: Mon 06 Nov, 2017 12:29
by ph0enix
Hm, that's bad. I wonder if I encrypt this file, how Far will be able to access it? Additionally, there are a couple more files history.db-shm and history.db-wal. I wonder if these need to be encrypted too, it might be cache or backup of history.

I wonder if there is a guide or best practice about securing Far command history?

Is command history secure?

Posted: Mon 06 Nov, 2017 14:49
by HaRT
ph0enix wrote:
Mon 06 Nov, 2017 12:29
if I encrypt this file, how Far will be able to access it?
If you do it via the Encrypted attribute, the access will be transparent to any application running with your user account (and no other user accounts). I don't know about the system accounts though. You might wish to read Microsoft documentation or some tutorials on NTFS encryption.

Is command history secure?

Posted: Mon 06 Nov, 2017 15:26
by ph0enix
Ah, cool, then I will encrypt whole folder, to make sure no bits of history outside of history.db are exposed.