No, you've hit the nail on the head. Obviously you can control access to your .login or whatever using the file system, otherwise as you say it is trivial to copy the value (cleartext or "encrypted"), but Perforce's security model is not that secure.

My understanding is that it fits the general philosophy - Perforce isn't and does not aim to be a ClearCase type of environment where everything can be controlled to the Nth degree. Also, the security in its current form is "good enough" for the majority of customers (unless you know different....). Perhaps as the product matures, they will give more thought to this area - one issue no doubt is the difficulty of supporting something more secure on all the platforms that Perforce runs on. On a personal note, I generally find you have better results from trusting colleagues too much than not enough - so the current level of security is usually OK.

One guideline for Windows users in particular is to never use p4 passwd to set the password because it stores it in the registry which can then be viewed by other users if they have access to the PC (particularly vulnerable if you are on win95/98). Instead they should manually enter the password (p4win prompts for it when you start up or switch users which is nice) in the environment. Obviously Unix users can do this too - just set the environment variable by hand when you log on - a bit of a pain and still vulnerable if someone else can look at your environment.

In this case the password would be set by editing the profile in p4 user.

The problem with using a single P4CONFIG file (however well controlled) to store it, is that you then can't use P4CONFIG for switching between different projects/client workspaces in different directories which is what P4CONFIG is so useful for (and indeed intended).

As a minor aside, it would be nice if Perforce at least gave a switch to p4 passwd which printed the hashed version that could be cut and pasted into an environment variable - a slightly safer thing to have around as previously mentioned.

Robert