How to hide/asterisk a part of the code in R? - r

Question

I have put in a password inside my code in Rstudio and I just want to somehow make it unclear so when I show my code to someone they don't see the password. Any suggestions for how to do this?
Thanks much

Answer 1

you should make a new R script (let's call it login_credentials.R) and store your password there
username <- "username_here"
password <- "password_here"
Once you save that, you can then load that script using source()
This will load the username and password variables.
source(login_credentials.R)
> username
[1] "username_here"
> password
[1] "password_here"
login_function(username,password)

Answer 2

You can obscure your password in the source file.
You can run something like
dput(charToRaw("Password"))
# as.raw(c(0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64))
to get numeric dump of your password. Then you can include in your script
pwd <- as.raw(c(0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64))
login("username", rawToChar(pwd))
That will at least make it less-human-readable and there won't be a variable in the environment browser with the text value (at least I think, i'm not sure how RStudio displays raw data).

Answer 3

You could create a .Renviron file in either your home directory or your project directory, where you store info like this in an environmental variable for use in your R scripts.
If this is the content of ~/.Renviron or /path/to/my/project/.Renviron:
YO=secretsecret
Then you can retrieve secretsecret via Sys.getenv("YO"). I wrote up how to do this for API authentication here.
Note: It can be very important to make sure your .Renviron file ends with a line break! Also, you'll need to restart R or Rstudio before this takes effect. Read up on R startup for more general info.

Answer 4

getPass package would be helpful in your case. This package has a function getPass() which is similar to readline(), the only differnce is that user's text is not printed as it is typed.
For example, consider that the following command creates connection to a database where you normally type the username and password.
Connection <- dbConnect(driver, connection_parameters, UserName, Password)
Try replacing the password with getPass() function:
library(getPass)
Connection <- dbConnect(driver, connection_parameters, UserName, getPass())
So whenever you run this line of code, you would see a popup window asking you to enter ur password. The password would not displayed as you type, but it would be masked as dots (or asterisk).
Password PopUp window
Though this requires you to enter the password every time you run, it at least gives you the ability to mask passwords.
Arguments for the function would be:
getPass(msg = "PASSWORD: ", noblank = FALSE, forcemask = FALSE)

Answer 5

A slightly more secure solution would be to store a hash of your password. This can be achieved with the digest function:
> digest::digest("password")
[1] "380796939c86c55d6aa8ea8c941f7652"
This implements the MD5 hash which is a one way cryptographic function and the original password can't be retrieved from this hash, i.e. there is no inverse function.
You will then need to modify the part of your code where you enter the password, hashing the entered password:
# Username and password part of code
username <- "username_here"
password_hash <- "380796939c86c55d6aa8ea8c941f7652"
...
# Password testing part of code
if (digest::digest(user_password_input) == password_hash){
"password_correct"
}else{
"password_incorrect"}
where user_password_input is a variable containing the entered password. The hashed password is secure because even if someone has your hashed password, they can't use it to get past the password verification. If they do enter the hash of you password it will be re-hashed and different to the password_hash variable.
Using hashes is good practice as your actual passwords are never stored in the code and the hashes by themselves are no use.