Trjtdtk

Here’s an example request we can make to the GitHub API:

curl 'https://api.github.com/authorizations' --user "USERNAME"

This will prompt for the account password, to continue:

Enter host password for user 'USERNAME':

If we don’t want to get the prompt, we can provide the password at the same time as the username:

curl 'https://api.github.com/authorizations' --user "USERNAME:PASSWORD"

But is this method less secure? Does curl send all the data at once, or does it first setup a secure connection, and only then send the USERNAME and PASSWORD?

Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS.

Locally this might be less secure, because:

• The password gets saved to the command history (~/.bash_history) as a part of the command, but this can be avoided by adding a space in front of the command before running it.


• On a shared system, it will usually be visible to others in ps, top and such, or by reading /proc/$pid/cmdline, for as long as the command is running.


• Storing the password unsecured in a script might pose a security risk, depending on where the script itself is stored.

No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted.

But as @Esa mentioned it is insecure locally. You can inspect how your data is transferred with tcpdump, tshark or Wireshark like following,

TCPDUMP

[root@arif]# tcpdump -i eth0 -n src host 192.168.1.1 and dst port 443 -XX

TSHARK

[root@arif]# tshark -O tls -f "tcp port 443" -f "ip src 192.168.1.1" -x

The best way to protect from local users is to use a ".netrc" file; the curl man page should have details and at least, if I recall, an example.