An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.
On the sender side a custom shared secret can be specified via the `croc send --code <SECRET>` command line. On the receiver side the shared secret, custom or not, is typically passed on the command line using the `croc <SECRET>` command line . The latter invocation variant is actively advocated by the output displayed on the sender side like:

```
On the other computer run

croc <SECRET>
```

By passing the shared secret on the command line it will become visible on the host's process list for all local users (on Linux and most UNIX like systems). On a multi user system this might allow other local users to get knowledge of the shared secret and to receive the files instead of the intended recipient.

To fix this, the shared secret should be read from stdin, a local file or an environment variable, even though it will be less intuitive than passing it on the command line.
Shared Secret Passed on Command Line Possibly Leaks to other Local Users
This is a GitHub Issue
repo:croc
owner:schollz
Title : Shared Secret Passed on Command Line Possibly Leaks to other Local Users
Issue date:

--- start body ---
On the sender side a custom shared secret can be specified via the `croc send --code <SECRET>` command line. On the receiver side the shared secret, custom or not, is typically passed on the command line using the `croc <SECRET>` command line . The latter invocation variant is actively advocated by the output displayed on the sender side like:

```
On the other computer run

croc <SECRET>
```

By passing the shared secret on the command line it will become visible on the host's process list for all local users (on Linux and most UNIX like systems). On a multi user system this might allow other local users to get knowledge of the shared secret and to receive the files instead of the intended recipient.

To fix this, the shared secret should be read from stdin, a local file or an environment variable, even though it will be less intuitive than passing it on the command line.
--- end body ---
