ssh-keygen -N Puts Your Passphrase in ps

The article discusses the security implications of using ssh-keygen with a passphrase passed as a command-line argument (-N) in a desktop application. The source material explains that this approach is insecure because the passphrase can be easily accessed through various sources such as /proc, shell history, auditd logs, and process-monitoring agents. The three main ways to handle passphrases are discussed:

1. Passing the passphrase via command-line arguments (-N), which is insecure as it lives in /proc and can be accessed through various means.

2. Using a pseudo-terminal (pty) to interact with the ssh-keygen process, but this approach is dependent on the exact prompt text, which changes over time.

3. Using the SSH_ASKPASS mechanism provided by OpenSSH to securely retrieve the passphrase. This involves setting the SSH_ASKPASS environment variable to a helper program that asks the user for the passphrase and reads the answer from the helper's stdout.

The article also highlights the importance of not storing the passphrase in argv after using SSH_ASKPASS, as this would still expose the secret. The preferred solution is to use the dialog provided by the SSH_ASKPASS helper program, which directly asks the user for the passphrase and prints it without passing it through the parent process.

The article emphasizes the need for developers to consider alternative channels for handling sensitive information, such as config files, environment variables, prompts, or dedicated helper programs.