Re: Password protection

[Richard Riley <rileyrg@googlemail.com>]

Daniel Pittman <daniel@rimspace.net> writes:

> Richard Riley <rileyrg@googlemail.com> writes:
>> Daniel Pittman <daniel@rimspace.net> writes:
>>> Lars Magne Ingebrigtsen <larsi@gnus.org> writes:
>>>
>>>> I find it sort of puzzling that we have to jump through all these hoops
>>>> to get at credentials.  I mean, Firefox users don't have to set up a gpg
>>>> agent or type their passwords a gazillion times, so why should users?
>>>
>>> I just shove mine into ~/.netrc, set appropriate permissions, and let the
>>> whole thing be.  I did my risk assessment, encrypted my entire disk, and was
>>> satisfied that by the time someone could steal my password through there the
>>> could equally steal it behind the back of any encryption.
>>>
>>> So, yeah, I agree with you.
>>
>> Nice. But your case is a total fringe case so doesn't justify not using
>> a proper agent for gpg key retrieval. To argue that its unnecessary
>> because your entire disk is already encrypted is probably not a strong
>> case ;)
>
> You are right: the disk encryption is an attractive nuisance in my argument.
>
> By the time someone can bypass the security precautions of having a file owned
> by me, on my single user machine, they have already won plenty of other ways.
>
>         Daniel
>
> ...besides, isn't using Gnus already a fringe activity?

Indeed! Which makes your case a fringe in a fringe ;)

The agent is used for many other things too in addition to gnus gpg file
decryption.

I log in once when emacs opens my "rgr.gpg" file and have a long timeout
set in the gpg-agent.conf.  Since the authinfo.gpg is encrypted with the
same key the agent takes care of it. No hardship at all.

The real benefits of course are the ability to use public (and free!)
git repos for ones dotemacs collection including the authinfo file
which, being encrypted as a .gpg, is pretty useless to anyone else. 


-- 
☘ http://www.shamrockirishbar.com, http://splash-of-open-sauce.blogspot.com/ http://www.richardriley.net