Password as arguments accessible via shell history

[valefar-on-discord]

Forward from:

• [ToB Audit] #6: Passwords are accessible via shell history (if passed in as arguments) ethereum/staking-deposit-cli#102

The 2020 Audit of staking-deposit-cli mentioned not allowing users to use command line arguments to specify passwords. Doing so would make the password accessible through the bash history.

A potential solution is to remove the option for mnemonic password and keystore passwords are input arguments and only allow them as inputs when running the CLI unless the user is executing with non-interactive enabled.

[remyroy]

I like the idea of restricting those password flags only when running this under the non-interaction option. This would have to be well documented.

[yorickdowne]

We can't restrict --mnemonic_password, as that's the only way a user can input it. That user may not want to run --non_interactive. This is a niche use however, extremely so.

We can restrict --keystore_password.

[remyroy]

As discussed with ToB, this isn't an issue that needs any specific action. We could tie the use of --keystore_password from the CLI to --non_interactive if we wanted and document it. I think I would be in favor of that even if that risks breaking some tools, scripts or automation. They should have to update their uses as well.