Question

This is a question with a rather small scope, but I’m running a lot of windows command prompt commands that involve using the admin password. I can either have part of the command be “/user:administrator /password:examplepassword”, where examplepassword is in plaintext, or I can just have “/user:administrator”, and it prompts me for the password, which I then enter masked (*******).

So, my question is simply this: is entering the password in the plaintext secure? (obviously besides the simple over-the-shoulder insecurity of it). Are command line arguments saved anywhere on the computer after a command prompt session is closed?

Thanks!

Answer 1

The Windows command prompt does not save history between invocations. There are several hacks about that try to emulate this behaviour, but the basic tool doesn’t support it.

Of course, command line statements can be stored in batch files and then it would be advantageous not to declare the password in-line.

Otherwise, you are correct. Using the second option merely protects you from shoulder-surfing or malicious access to an open command prompt (with a live history). Personally I think those are sufficient reasons to use the second option.

Finally, it’s worth noting that both solutions are vulnerable to key logging.