Re: Password protection

[Lars Magne Ingebrigtsen <larsi@gnus.org>]

Ted Zlatanov <tzz@lifelogs.com> writes:

> Look at it the other way: why shouldn't they set up a GPG agent or enter
> a passphrase?  (assuming that entering the passphrase more than once is
> a bug I plan to fix)

Entering a pass phrase (once) is fine if they've chosen to set things up
like that.  Firefox also allows the passwords to be, er,
password-protected.  :-)

But setting up a GPG agent is way too much for a normal user.  I think.

> So I'd argue that Emacs has, practically speaking, better security
> *externally* than Firefox, Chrome, or most other web browsers with a
> authinfo.gpg file.  Now from the inside, yes, it's a candy store of
> passwords, and that's a concern.  But Doing It Right requires a lot of
> infrastructure that Emacs Lisp doesn't have.  And Firefox and Chrome
> extensions can get at your passwords too AFAIK.

Yeah.  A `process-send-password' function makes the candy somewhat less
tasty, I think...

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen