Quote:
Originally Posted by
arizah
Hi Jim,
I like this approach
Then you didn't see the reply immediately after it:
Quote:
the popen() call just allowed anyone on the system to capture the password
We know what you
want to do but that idea is
fundamentally flawed and cannot be made better. One way or another
client code still knows how to generate the password, and feeds it as raw plaintext into other things, which really can't be made secure.
You have to try something
completely different, like the many other suggestions made repeatedly in this thread, so the plaintext password doesn't need to be on your system.
