security - Python: securing sensitive variable contents within a script -

i need user input password script can use password perform ldap operation on account. it's simple:

password = getpass.getpass()     ldapconn.simple_bind_s(binddn, password) 

even though password never leaving script , never displayed in plain text, isn't still vulnerable memory dump? what's best way secure password within script, still make use of it?

this post interesting: https://security.stackexchange.com/questions/29019/are-passwords-stored-in-memory-safe

primarily because answers confirm suspicion passwords stored in ram not safe. question is, how 1 supposed work requires sensitive information stored in ram? no 1 on post posts practical real-world solution, lot of confirmation , details why ram not safe. using short example of ldap connection above, concrete changes make better secure password variable?

using short example of ldap connection above, concrete changes make better secure password variable?

none. either:

• need have plain text send ldap api,
  • in case need have plain text, attacker get
  • or need encrypted text decrypt, attacker after decrypt it
• need password hash send ldap api
  • then attacker hash , use it. it's plain password @ point.

the solutions exist have design not involve prompting user password @ all, , not involve sending plain text passwords other services.

e.g. have working kerberos environment synchronised time, users getting kerberos tickets @ first login, , tickets being used authenticate services without password prompts. tickets have limited lifetime , kerberos replay detection built in, if taken memory less useful password.

so user hits password prompt once entire environment, not once per script run or service access, , password handled 1 centralized, reviewed, low level os process.