🚀 go-pugleaf

A good way of thinking about the definition of a 'covert channel' as
opposed to other kinds of security flaws is to think in terms of
mandatory access control (MAC) concepts. The essential idea in
conventional MAC is that more sensitive stuff is absolutely kept
separate from less sensitive stuff. For example, data marked "secret"
is never visible in "unclassified" portions of the system. The secret
stuff is never, never allowed on the other side of the boundary.

Covert channels are techniques that move things across the boundary,
circumventing the security controls.

The password example is in a system without MAC. There is no MAC
boundary between the password and the unauthorized recipient.
Therefore it's not a covert channel.

Rick.
smith@sctc.com   arden hills, minnesota