Gnus PGG: Saving cleartext

Gnus PGG: Saving cleartext

[Christopher Culver]

When I receive a GPG-encrypted message in Gnus and file it away in my
mail archive, I have to enter the GPG passphrase to decrypt it every
single time I want to read it. This is an inconvenience, and if I ever
lose my private key I'll never be able to read the message again. Is
there any way to make Gnus permanently replace the encrypted message
with the decrypted cleartext, and if not, is that functionality on its
way?
** Posted from http://www.teranews.com **

Re: Gnus PGG: Saving cleartext

[Cor Gest]

Some entity, AKA Christopher Culver <crculver@christopherculver.com>,
wrote this mindboggling stuff:
(selectively-snipped-or-not-p)

> When I receive a GPG-encrypted message in Gnus and file it away in my
> mail archive, I have to enter the GPG passphrase to decrypt it every
> single time I want to read it. This is an inconvenience, and if I ever
> lose my private key I'll never be able to read the message again. Is
> there any way to make Gnus permanently replace the encrypted message
> with the decrypted cleartext, and if not, is that functionality on its
> way?

Yes, yes-yes, yes and (hopefully NEVER).

BUT , have you thought about why you used encryption in the first place,
storing it in clear defies any logic to use any encrypotion at all.

That is like hiring an armoured car and 10 nasties to tranport you gold and then
dumping all that metal as a scrapheap in your frontyard.

when reading the clear text : write the pgg-output-buffer to a file.

Cor 
-- 
	Mijn Tools zijn zo modern dat ze allemaal eindigen op 'saurus'
        (defvar My-Computer '((OS . "GNU/Emacs") (IPL . "GNU/Linux")))
	     SPAM DELENDA EST       http://www.clsnet.nl/mail.php
                 1st Law of surviving a gunfight : Have a gun 

Re: Gnus PGG: Saving cleartext

[John Hasler]

Cor writes:
> BUT , have you thought about why you used encryption in the first
> place...

He didn't.  The sender did,

> ...storing it in clear defies any logic to use any encrypotion at all.

Perhaps his threat model is such that local access is not a concern.
Perhaps his disk is encrypted.  Perhaps the messages are such that secrecy
is unimportant once they've been delivered.  Perhaps he has correspondents
who habitually encrypt all mail even when there is no secret content (I
sometimes receive such messages).

A "permanently decrypt" command would be very convenient, though it should
never be the default.
-- 
John Hasler 
john@dhh.gt.org
Dancing Horse Hill
Elmwood, WI USA

Re: Gnus PGG: Saving cleartext

[Cor Gest]

Some entity, AKA John Hasler <john@dhh.gt.org>,
wrote this mindboggling stuff:
(selectively-snipped-or-not-p)


>> BUT , have you thought about why you used encryption in the first
>> place...
>
> He didn't.  The sender did,

Yes, but why ?  the receipient must have given his public key
to achieve that, so if one doe not care about it why have a key in the
first place ?
  
>> ...storing it in clear defies any logic to use any encrypotion at all.

> Perhaps his threat model is such that local access is not a concern.

subpoena's ? I rest my case ... ;-)
(better not keep even the crypted version on any disk too)

> A "permanently decrypt" command would be very convenient, though it should
> never be the default.
Agreed !

But storing in clear-text is allready possible, which needs a consious
decision and action to do so.

Cor
-- 
	Mijn Tools zijn zo modern dat ze allemaal eindigen op 'saurus'
        (defvar My-Computer '((OS . "GNU/Emacs") (IPL . "GNU/Linux")))
	     SPAM DELENDA EST       http://www.clsnet.nl/mail.php
                 1st Law of surviving a gunfight : Have a gun 

Re: Gnus PGG: Saving cleartext

[John Hasler]

Cor Gest writes:
> Yes, but why ?  the receipient must have given his public key...

It need only be on the keyservers.

> ...if one doe not care about it why have a key in the first place ?

I have a key because I am a Debian developer and must sign my packages.
Others may have keys so that they can sign messages so that they can be
authenticated but see no need for secrecy.

I wrote:
> Perhaps his threat model is such that local access is not a concern.

Cor Gest writes:
> subpoena's ? I rest my case ...

On what?  If I did Internet banking (I don't) I would require my bank to
encrypt any statements they emailed to me but I certainly would see no need
to encrypt them locally.  The threat model would be identity theft, not
breach of secrecy, and subpoenas would be no threat at all (nor would
encryption be any protection in a civil case).

> better not keep even the crypted version on any disk too

Do you destroy all your bank statements immediately after reading them?

> ...storing in clear-text is allready possible, which needs a consious
> decision and action to do so.

Too much action.  A simple "save-unencrypted" command would be useful, but
I know of none.  If you do please tell me about it.
-- 
John Hasler 
john@dhh.gt.org
Dancing Horse Hill
Elmwood, WI USA

Re: Gnus PGG: Saving cleartext

[Cor Gest]

Some entity, AKA John Hasler <john@dhh.gt.org>,
wrote this mindboggling stuff:
(selectively-snipped-or-not-p)

>> subpoena's ? I rest my case ...
>
> On what?  If I did Internet banking (I don't) I would require my bank to
> encrypt any statements they emailed to me but I certainly would see no need
> to encrypt them locally.  The threat model would be identity theft, not
> breach of secrecy, and subpoenas would be no threat at all (nor would
> encryption be any protection in a civil case).

nah , those can be subpoenad from your bank without much hassle anyway.
so don't bother...

>> better not keep even the crypted version on any disk too
It is about 'private stuff', you do NOT want _anyone_ to get at.
if nothing is stored, nothing can be retrieved.


> Do you destroy all your bank statements immediately after reading them?

Nope, but I refuse to do any 'banking' online anyway.


and, yes , there are many _other_ uses for pgg too, authentication is
one of those uses.

Cor

-- 
	Mijn Tools zijn zo modern dat ze allemaal eindigen op 'saurus'
        (defvar My-Computer '((OS . "GNU/Emacs") (IPL . "GNU/Linux")))
	     SPAM DELENDA EST       http://www.clsnet.nl/mail.php
                 1st Law of surviving a gunfight : Have a gun 

Re: Gnus PGG: Saving cleartext

[John Hasler]

Cor Gest writes:
> nah , those [bank statements] can be subpoenad from your bank without
> much hassle anyway.  so don't bother [to encrypt them locally]...

And yet it would still be desireable to have them sent encrypted.  Thus a
purpose exists for decrypting email immediately upon receipt and saving the
clear text.

> It is about 'private stuff', you do NOT want _anyone_ to get at.

For me nothing like that exists outside my head.
-- 
John Hasler 
john@dhh.gt.org
Dancing Horse Hill
Elmwood, WI USA

Re: Gnus PGG: Saving cleartext

[Cor Gest]

Some entity, AKA John Hasler <john@dhh.gt.org>,
wrote this mindboggling stuff:
(selectively-snipped-or-not-p)


> And yet it would still be desireable to have them sent encrypted.  Thus a
> purpose exists for decrypting email immediately upon receipt and saving the
> clear text.

irrelevant, if you do not give you mail address to the bank, they
cannot send anything, can they ? ;-)

>> It is about 'private stuff', you do NOT want _anyone_ to get at.
>
> For me nothing like that exists outside my head.

That obsoletes the whole purpose of having crypt at all, doesn't it?


Cor

-- 
	Mijn Tools zijn zo modern dat ze allemaal eindigen op 'saurus'
        (defvar My-Computer '((OS . "GNU/Emacs") (IPL . "GNU/Linux")))
	     SPAM DELENDA EST       http://www.clsnet.nl/mail.php
                 1st Law of surviving a gunfight : Have a gun 

Re: Gnus PGG: Saving cleartext

[Christopher Culver]

Cor Gest <cor@clsnet.nl> writes:
> Yes, yes-yes, yes and (hopefully NEVER).
>
> BUT , have you thought about why you used encryption in the first place,
> storing it in clear defies any logic to use any encrypotion at all.

Nonsense. PGP has traditionally been explained as the equivalent of
sending letters in envelopes instead of postcards. It keeps the
message confidential while it is transmitted and delivered. Once it
reaches me, I prefer to rely on general hard drive encryption to
protect everything.

> when reading the clear text : write the pgg-output-buffer to a file.

This should be automated. Saving the decrypted cleartext of a message
was a common feature in mail clients of the 1990s. I'd hate to think
we've reverted.
** Posted from http://www.teranews.com **

Re: Gnus PGG: Saving cleartext

[Cor Gest]

Some entity, AKA Christopher Culver <crculver@christopherculver.com>,
wrote this mindboggling stuff:
(selectively-snipped-or-not-p)


>> when reading the clear text : write the pgg-output-buffer to a file.
>
> This should be automated. Saving the decrypted cleartext of a message
> was a common feature in mail clients of the 1990s. I'd hate to think
> we've reverted.

I beg to differ, it's your machine, so you are free to do whatever
you like with your files. 

Cor

-- 
	Mijn Tools zijn zo modern dat ze allemaal eindigen op 'saurus'
        (defvar My-Computer '((OS . "GNU/Emacs") (IPL . "GNU/Linux")))
	     SPAM DELENDA EST       http://www.clsnet.nl/mail.php
                 1st Law of surviving a gunfight : Have a gun