GNU bug report logs - #72462
Having to store password in mutliple places

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 72462 in the body.
You can then email your comments to 72462 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Pranshu <pranshusharma366 <at> gmail.com>
To: bug-gnu-emacs <at> gnu.org
Subject: Having to store password in mutliple places
Date: Mon, 05 Aug 2024 00:01:36 +1000

Right now to get a functional gnus setup in which I can send and recive
mail, I am having to store my password is 2 places, which is the mail
sources variable, and the authinfo file.  This makes it extremly
annoying and insecure, especially since I cannot encrypt one fo the
places I store the password.

If I remove password from authinfo file, I can still recive mail but not
send any.  And if I remove password from mail sources, I cannot recive
mail without typing my whole password when prompted on gnus startup.

Following is the code I have:

Elisp code:
----------------------------------------------------------
(setq user-mail-address "pranshusharma366 <at> gmail.com")
(setq user-full-name "Pranshu")
(setq smtpmail-smtp-server "smtp.gmail.com")
(setq smtpmail-smtp-service 465)
(setq smtpmail-stream-type  'ssl)
(setq mail-sources `((pop :server "pop.gmail.com"
						  :user ,user-mail-address
						  :password "**********" ; Password line
						  :port 995)))
----------------------------------------------------------


Authinfo:
----------------------------------------------------------
machine smtp.gmail.com login pranshusharma366 <at> gmail.com password **********  port 465
----------------------------------------------------------

Message #8 received at 72462 <at> debbugs.gnu.org (full text, mbox):

From: Andreas Schwab <schwab <at> linux-m68k.org>
To: Pranshu <pranshusharma366 <at> gmail.com>
Cc: 72462 <at> debbugs.gnu.org
Subject: Re: bug#72462: Having to store password in mutliple places
Date: Sun, 04 Aug 2024 16:42:33 +0200

On Aug 05 2024, Pranshu wrote:

> Following is the code I have:
>
> Elisp code:
> ----------------------------------------------------------
> (setq user-mail-address "pranshusharma366 <at> gmail.com")
> (setq user-full-name "Pranshu")
> (setq smtpmail-smtp-server "smtp.gmail.com")
> (setq smtpmail-smtp-service 465)
> (setq smtpmail-stream-type  'ssl)
> (setq mail-sources `((pop :server "pop.gmail.com"
> 						  :user ,user-mail-address
> 						  :password "**********" ; Password line
> 						  :port 995)))
> ----------------------------------------------------------
>
>
> Authinfo:
> ----------------------------------------------------------
> machine smtp.gmail.com login pranshusharma366 <at> gmail.com password **********  port 465
> ----------------------------------------------------------

You should add an entry to authinfo for machine pop.gmail.com, then you
can remove the credentials from mail-sources.  That's still writing the
password twice, but at least it's next to each other in the same file.

-- 
Andreas Schwab, schwab <at> linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."

Message #11 received at 72462 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: Pranshu <pranshusharma366 <at> gmail.com>
Cc: 72462 <at> debbugs.gnu.org
Subject: Re: bug#72462: Having to store password in mutliple places
Date: Sun, 04 Aug 2024 16:44:37 +0200

Pranshu <pranshusharma366 <at> gmail.com> writes:

Hi Pranshu,

> Right now to get a functional gnus setup in which I can send and recive
> mail, I am having to store my password is 2 places, which is the mail
> sources variable, and the authinfo file.  This makes it extremly
> annoying and insecure, especially since I cannot encrypt one fo the
> places I store the password.
>
> If I remove password from authinfo file, I can still recive mail but not
> send any.  And if I remove password from mail sources, I cannot recive
> mail without typing my whole password when prompted on gnus startup.
>
> Following is the code I have:
>
> Elisp code:
> ----------------------------------------------------------
> (setq user-mail-address "pranshusharma366 <at> gmail.com")
> (setq user-full-name "Pranshu")
> (setq smtpmail-smtp-server "smtp.gmail.com")
> (setq smtpmail-smtp-service 465)
> (setq smtpmail-stream-type  'ssl)
> (setq mail-sources `((pop :server "pop.gmail.com"
> 						  :user ,user-mail-address
> 						  :password "**********" ; Password line
> 						  :port 995)))
> ----------------------------------------------------------
>
>
> Authinfo:
> ----------------------------------------------------------
> machine smtp.gmail.com login pranshusharma366 <at> gmail.com password **********  port 465
> ----------------------------------------------------------

You can store both passwords in .authinfo, like

--8<---------------cut here---------------start------------->8---
machine smtp.gmail.com login pranshusharma366 <at> gmail.com password **********  port 465
machine pop.gmail.com login pranshusharma366 <at> gmail.com password **********  port 995
--8<---------------cut here---------------end--------------->8---

No need to keep it in the :password slot of mail-sources.

Best regards, Michael.

Message #14 received at 72462 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Andreas Schwab <schwab <at> linux-m68k.org>
Cc: pranshusharma366 <at> gmail.com, 72462 <at> debbugs.gnu.org
Subject: Re: bug#72462: Having to store password in mutliple places
Date: Sun, 04 Aug 2024 17:47:28 +0300

> Cc: 72462 <at> debbugs.gnu.org
> From: Andreas Schwab <schwab <at> linux-m68k.org>
> Date: Sun, 04 Aug 2024 16:42:33 +0200
> 
> On Aug 05 2024, Pranshu wrote:
> 
> > Following is the code I have:
> >
> > Elisp code:
> > ----------------------------------------------------------
> > (setq user-mail-address "pranshusharma366 <at> gmail.com")
> > (setq user-full-name "Pranshu")
> > (setq smtpmail-smtp-server "smtp.gmail.com")
> > (setq smtpmail-smtp-service 465)
> > (setq smtpmail-stream-type  'ssl)
> > (setq mail-sources `((pop :server "pop.gmail.com"
> > 						  :user ,user-mail-address
> > 						  :password "**********" ; Password line
> > 						  :port 995)))
> > ----------------------------------------------------------
> >
> >
> > Authinfo:
> > ----------------------------------------------------------
> > machine smtp.gmail.com login pranshusharma366 <at> gmail.com password **********  port 465
> > ----------------------------------------------------------
> 
> You should add an entry to authinfo for machine pop.gmail.com, then you
> can remove the credentials from mail-sources.  That's still writing the
> password twice, but at least it's next to each other in the same file.

I think writing the password twice is unavoidable, since these are two
separate servers/services: one for receiving email, the other for
sending.  Am I right?

Message #19 received at 72462-done <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: pranshusharma366 <at> gmail.com
Cc: 72462-done <at> debbugs.gnu.org, schwab <at> linux-m68k.org
Subject: Re: bug#72462: Having to store password in mutliple places
Date: Sat, 17 Aug 2024 11:52:07 +0300

> Cc: pranshusharma366 <at> gmail.com, 72462 <at> debbugs.gnu.org
> Date: Sun, 04 Aug 2024 17:47:28 +0300
> From: Eli Zaretskii <eliz <at> gnu.org>
> 
> > Cc: 72462 <at> debbugs.gnu.org
> > From: Andreas Schwab <schwab <at> linux-m68k.org>
> > Date: Sun, 04 Aug 2024 16:42:33 +0200
> > 
> > On Aug 05 2024, Pranshu wrote:
> > 
> > > Following is the code I have:
> > >
> > > Elisp code:
> > > ----------------------------------------------------------
> > > (setq user-mail-address "pranshusharma366 <at> gmail.com")
> > > (setq user-full-name "Pranshu")
> > > (setq smtpmail-smtp-server "smtp.gmail.com")
> > > (setq smtpmail-smtp-service 465)
> > > (setq smtpmail-stream-type  'ssl)
> > > (setq mail-sources `((pop :server "pop.gmail.com"
> > > 						  :user ,user-mail-address
> > > 						  :password "**********" ; Password line
> > > 						  :port 995)))
> > > ----------------------------------------------------------
> > >
> > >
> > > Authinfo:
> > > ----------------------------------------------------------
> > > machine smtp.gmail.com login pranshusharma366 <at> gmail.com password **********  port 465
> > > ----------------------------------------------------------
> > 
> > You should add an entry to authinfo for machine pop.gmail.com, then you
> > can remove the credentials from mail-sources.  That's still writing the
> > password twice, but at least it's next to each other in the same file.
> 
> I think writing the password twice is unavoidable, since these are two
> separate servers/services: one for receiving email, the other for
> sending.  Am I right?

No further comments, so I presume the problem is solved by the above
advice, and I'm therefore closing this bug.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.