Re: Entering passphrase twice when sending PGP signed message

[Simon Josefsson <jas@extundo.com>]

Hrvoje Niksic <hniksic@xemacs.org> writes:

> Simon Josefsson <jas@extundo.com> writes:
>
>> Hrvoje Niksic <hniksic@xemacs.org> writes:
>>
>>> How about remembering the passphrase and reusing it the second time?
>>> The passphrase would be forgotten the moment the mail sending process
>>> is finished.  At first that sounds like a violation of passphrase
>>> privacy, but think about it: as long as the string is not copied
>>> around, it's no more dangerous to use it twice and delete it than to
>>> prompt for it twice, deleting it each time around.
>>
>> This is supposed to work by default,
>
> Now I'm somewhat confused because your previous mail sounded exactly
> the opposite -- like it's not supposed to work by default.  But then
> again, I haven't studied the code, it might be a much more complex
> issue than I'm aware of.

Sorry if I gave the wrong impression, I (incorrectly) jumped to the
assumption that you wanted GPG to only be run once, thus removing the
need for two passphrase inputs.  I argued that running GPG twice was a
feature, but I wasn't very clear.  The passphrase cache should work by
default, both for signing and encrypting IMHO, so if this was your
only concern, it is only a Small Matter Of Bugfixing.

On further thought, one could argue that it should be possible to
customize the passphrase cache to a mode where decryption happens
automatically using the passphrase cache, but signing do require
password input every time, or at least a yes-or-no-p.  Since I use an
infinite passphrase cache lifetime, to be able to read encrypted
messages easily, I'd want this to make sure I don't sign something I
wasn't aware of.

>> but if you have multiple PGP identities, there is a known problem.
>
> But I don't have multiple PGP identities, at least not for now.

Hm, perhaps that wasn't the only criteria.  The passphrase seem to
work only for some people.

>> For me, the passphrase is cached so everything is decrypted
>> automatically, but for signing I have to enter it (twice).
>
> I haven't tried encryption/decryption yet.  I wanted to start with
> something simple, such as signing, and stumbled on the
> type-the-passphrase-twice thing which makes (to me) the whole
> experience a rather unpleasant one.

I agree.