Overwrite std::cin read-buffer after reading password - c++

Question

After reading a password from std::cin
std::cout << "Password: ";
SecureString pw{}; // secure string, wipes automatically on destruction
SetConsoleEcho(false); // hide input in terminal
std::getline(std::cin, pw); // input the password
SetConsoleEcho(true); // switch echo back on
the password stays stored in the read buffer of cin (heap memory) until it is overwritten with new input and can easily be sniffed with tools like Process Hacker or would be written to disk in case of a memory dump.
Does anyone know how the std::cin.rdbuf() can be cleared/overwritten, ideally in a cross-platform way? Or is there a way how to avoid using the buffer in the first place?
The above code uses SecureString which is implemented using Crypto++'s AllocatorWithCleanup which wipes memory at destruction. SetConsoleEcho switches the console echo on/off in order to avoid seeing the plain text password on screen.
I realize this question is very similar to this one but it's been over 10 years and the accepted answer actually does not answer the question.

Answer 1

The linked post has all the answers you need and unfortunately there isn't a way to securely read and then clear the password with 0 risk of it being exposed. See
Even if you scribble over the buffer immediately, it's still possible the password is written to disk. A system i/o buffer might be paged to disk, as might the working memory which std::cin is in. I used to develop forensic software which sniffed out exactly these conditions.
Furthermore if a malicious actor has access to the PC a keylogger can just be used to extract the password.

Answer 2

Or is there a way how to avoid using the buffer in the first place?
I found a cross-platform way (Linux, Mac, Windows) how to avoid the read buffer of cin using a readline replacement library. I used replxx but other readline replacement libraries will likely do as well.
I created a simple wrapper class PasswordInput around replxx that clears its input buffer on every key stroke and stores the entered password in a secure string using Crypto++'s AllocatorWithCleanup. The secure string is automatically wiped after a password digest is created, thus leaving no copy of the plain password in process memory.
All this achieves is to avoid having the plain password in process memory for longer than needed. It does not guard against keyloggers nor against the possibility of leaking the password if the process crashes while calculating the digest nor against well timed sniffing attacks nor against any other possible attack vectors.
So far I've only tested on Windows and I only did basic memory sniffing tests using Process Hacker. These showed no trace of the plain password (contrary to using std::cin)
Header file:
using SecureString =
std::basic_string<char, std::char_traits<char>, CryptoPP::AllocatorWithCleanup<char>>;
class PasswordInput {
public:
PasswordInput();
void Read(const std::string& prompt);
inline const SecureString& Secret() const { return secret_; }
private:
void RxPwModifyCb(std::string& line, int& pos);
Replxx rx_;
SecureString secret_;
};
Implementation:
namespace ph = std::placeholders;
PasswordInput::PasswordInput() :
rx_{}
{
rx_.set_modify_callback(std::bind(&PasswordInput::RxPwModifyCb, this, ph::_1, ph::_2));
}
void PasswordInput::Read(const std::string& prompt)
{
char const* cinput{nullptr};
do
{
cinput = rx_.input(prompt);
} while ((cinput == nullptr) && (errno == EAGAIN));
}
void PasswordInput::RxPwModifyCb(std::string& line, int& pos)
{
if (!line.empty())
{
secret_.append(1, line[0]);
line.clear();
}
}
Usage:
PasswordInput pwi{}; // create password input handler
pwi.Read("Password: "); // read the password
std::cout << "\x1b[A" << "\33[2K\r"; // go one line up, delete line and go to beginning (does nothing in terms of security but looks cool)
CalculatePassphrase(pwi.Secret().c_str(), pwi.Secret().size()); // Scrypt, pbkdf2, etc..
Please note this is not complete code and it needs replxx and Crypto++ libraries linked