
SECURITY NOTES:

The feature of giving pcp a telephone number leads to the
problem that the chat script (with the password) has to be 
specified in "config.h" -- or in the command line, 
but this is even worse.
The string containing the chat script and the password is
an application resource and can be requested by Xt
utilities like editres.
Also a command line like
 ... "ogin:" "root" "sword:" `cat /etc/ppp/rpass` ...
is not safe: The shell, which executes the ppp command, 
expands the `expression` to the contents of the file. This 
expanded command line can be shown via ps.

The safest way -- although this way is far away from being 
REALLY safe -- is to have a separate chat script file only
accessible from root or the owner.

If there are wishes to have a password requester, which opens
every time a ppp connection is being established, 
contact me.
Passwords should not be stored in a file - 
even if the file is 600.
However, note that that pppd can at least be held from
wrinting your password to the logfile by being passed \q as the 
password's prefix. 

I am not too sure on the security of this program, but I use it myself 
all the time. So please send me any suggestions to prevent it being a 
security hole.
PCP needs not to be run as root.





