I'm currently fascinated by
strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both
strace su and
strace ssh. Both commands displayed the password I typed in the strace output.
su kept complaining of an incorrect password while
ssh managed to log in normally.
- Is this a security flaw or am I missing something?
sureporting an incorrect password as a security measure because it detected it was being run through
strace? If so how can it tell that it's being invoked through
strace? Does it check
- How much damage can be caused by something like
alias su="strace -o /tmp/output.log su"