It’s already too late at this point. Anybody on your machine can read the commands you are running, for example with ps. You should instinctively avoid entering anything in plaintext into a terminal which you don’t want other people to see. Any command line tool worth its salt will provide alternative ways of passing secrets (using configuration files for example).
unset HISTFILE
exit
So, a given config file can have permissions so that the file owner can read and write, but other users cannot. Like your ssh keys.
But ‘ps’ can be run by anyone, and it can typically access the whole command line you used.
So if you do `date`, it'll end up in the history file but if you do ` date` (one space prefixed), it won't. One `clear` later and it's like the command was never run.
This is why I always mount /proc with the "hidepid=2" option (as well as the "gid=<n>" option to ensure that doesn't apply to the members of a specific group, such as the "admins" of the box).
With Perl, for example, assign to $0.
$0="what /bin/ps will see";
Most CLI programs that need sensetive information as input should either do it interactively (a la sudo), as standard input, or configuration file. If worst comes to very worst, you can put the sensitive info in a text file and use backticks. For example:
some-command --username=jedimastert --password=`cat secret.txt`This will not work in the way that you suggest. The output of ps will show the result of `cat secret.txt` and thus reveal the password.