Re: Security flaw in pgg-gpg-process-region?

[Richard Stallman <rms@gnu.org>]

    When decrypting PGP messages PGG will send your passphrase along
    with data, so if Emacs process is killed and [someone else has]
    stolen your note PC, your passphrase can also be stolen from the
    temp file.

Since it is not likely for Emacs to be killed just while it is running
GPG, I think that very few users have such temp files lying around.
So the thief would need to be very lucky (as well as knowing about
such things) in order get anyone's pass phrase.

Therefore, I think it is not desperately urgent to fix this.
We should fix it if it is feasible, but it may be hard.

    It would probably be fairly simple to change the implementation to
    unlink the temp file _before_ writing the contents and pass only the
    still-open file-descriptor (after rewinding) to Fcall_process (or
    rather, to some common subroutine derived from Fcall_process).

We would have to unlink the file before writing the contents into it.
That would be somewhat more work, since Fwrite_region needs to be able
to use an already-open descriptor, too.  Still, it is possible in
principle.  Would someone like to try it?


We could make the problem even more unlikely if we can arrange for
Emacs to delete any such temp files that are lying around when it
starts.  For this, the hard part is dealing with multiple machines
that share the same temp file directory.  In that case, Emacs can't
tell whether the Emacs that wrote a certain temp file is still alive.
However, if Emacs put the machine name, user name and process ID into
the file name, then each Emacs could tell which of these temp files
are from the same machine and same user; then it could check whether
those processes are still alive.

This way, the thief would have to get your machine after Emacs dies
while running GPG and before you start another Emacs.