[Question] Docker is fine, but what about docker-helpers?

[tr4l]

Docker PR

They are a docker PR :

• Added probe that scans for Docker registry creds #25

The PR looks for creds on known files.

The PR mention credentials helpers.

Docker credentials helpers

Now, helpers is the "good" way to have docker secrets, but some (most?) helpers are "just" binaries that provide the password as cleartext.

The secrets itself is not in cleartext, but the helpers will do all the works to provide the clear password to docker.

Some helpers may require a manual validation, but most won't.

My old powershell stuff for reference:

• https://github.com/tr4l/misc/tree/master/PowerShell/Credential_Access/dockerpass

The question

Should bagel run the known helpers that don't ask for user interaction ?

[SUSTAPLE117]

@tr4l yes imo bagel could definitely do this like we do with gh auth token

[fproulx-boostsecurity]

@SUSTAPLE117 if there's user interaction we need to be careful not to hang the scan and have timeout of like 3 seconds max.