Privacy Leakage: feed password may be revealed in output

[cdrnet]

When paket fails it may leak the user's password in the output:

Paket failed with:
        Could not find versions for package SomePackageName in any of the sources in [Nuget
   {Url =
     "https://feed-url";
    Authentication = Some (ConfigAuthentication ("user name","actual password"));}].

We may want to skip printing the actual password there.

[forki]

Yes we need to implement tostring for the Auth type. Care to send a PR?

[cdrnet]

Sure. Would it also make sense to use SecureString instead of String for the password?

[forki]

I guess it could be done, but most of the the passwords can be found on
your system (often in deps file) anyway.
On Nov 16, 2015 8:43 AM, "Christoph Ruegg" [email protected] wrote:

Sure. Would it also make sense to use SecureString instead of String for
the password?

—
Reply to this email directly or view it on GitHub
#1224 (comment).

[cdrnet]

Fair enough, I'll just open a PR for ToString of Credentials etc for now. Thanks.