It's unsafe because it exposes your password a number of different ways.
- Any user can see it in the output of programs like
top
and ps aux -www
. They don't need to be root to see your processes.
- It gets logged into your shell history, so if you do something foolish like
chmod 777 ~
, anybody and everybody can cat ~user/.history
and view the password.
If case 2 occurs, then foolishness will give them access to your SSH private key. If your private key does not require a password then it is compromised. If it does require a password then it's not compromised (although they can attempt to crack it).
Let's assume that the user here isn't foolish, has a good understanding of Unix files and unix file permissions, and would never run chmod 777 ~
because the user is not a noob.
Anybody on the system can view the PS output of your command. Let's say you purchase web hosting from some small, insecure web hosting company. They give you a chrooted home directory on a shared server and allow you to access the server via SSH in addition to SFTP and FTP. Providing a password in the URL is a viable security vulnerability. SSH keys would totally prevent this because even though the user has access to the machine they do not have access to your private key.