I have a program (not written by me) that I would like to use. It authenticates to an online service using a username and password that I would like to keep private. The authentication information may be passed to the program in two ways: either directly as command-line arguments or via a plaintext configuration file, neither of which seem particularly secure.
I would like to write a Python script to manage the launching of this program and keep my credentials away from the prying eyes of other users of the machine. I am running in a Linux environment. My concerns with the command-line approach are that the command line used to run the program is visible to other users via the /proc filesystem. Likewise, a plaintext configuration file could be vulnerable to reading by someone with the appropriate permissions, like a sysadmin. 
Does anyone have any suggestions as to a good way to do this? If I had some way of obscuring the arguments used at the command line from the rest of the system, or a way to generate a configuration file that could be read just once (conceptually, if I could pipe the configuration data from the script to the program), I would avoid the situation where my credentials are sitting around potentially readable by someone else on the system.
Tough problem. If you have access to source code of the program in question, you can change argv[0] after startup. On most flavors of *nix, this will work.
The config file approach may be better from a security perspective.
If the config file can be specified at run time, you could generate a temp file (see mkstemp), write password there, and invoke subprocess. You could even add a small delay (to give subprocess time to do its thing) and possibly even remove the config file.
Of course the best solution is to change the program in question to read password from stdin (but it sounds like you already knew that)
Securely passing credentials to a program via plaintext file or command line